CVE-2023-6731: 
WordPress vulnerability analysis and mitigation

The WP Show Posts plugin for WordPress contains a vulnerability (CVE-2023-6731) related to unauthorized access of data due to missing capability checks on multiple AJAX functions. This vulnerability affects all versions up to and including 1.1.5. The issue was discovered and reported by Wordfence, with a CVSS v3.1 base score of 4.3 (MEDIUM) (NVD).

The vulnerability stems from missing capability checks on multiple AJAX functions in the WP Show Posts plugin. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating network accessibility, low attack complexity, and required low privileges for exploitation. No user interaction is needed for the attack (NVD).

The vulnerability allows authenticated attackers with subscriber-level access or higher to view arbitrary post metadata, list posts, and access terms and taxonomies. The impact is limited to unauthorized data access without any system modification capabilities (NVD).

The vulnerability requires an authenticated user with at least subscriber-level access to exploit. The attack vector is network-accessible and requires low complexity to execute, making it relatively straightforward to exploit for authenticated users (NVD).