CVE-2023-6824: 
WordPress vulnerability analysis and mitigation

The WP Customer Area WordPress plugin before version 8.2.1 contains a security vulnerability identified as CVE-2023-6824. The vulnerability was discovered and disclosed on January 16, 2024, affecting the plugin's AJAX actions functionality. The issue impacts installations of the WP Customer Area WordPress plugin versions prior to 8.2.1 (WPScan, NVD).

The vulnerability stems from improper validation of user capabilities in certain AJAX actions within the plugin. This security flaw has been assigned a CVSS v3.1 base score of 6.5 (Medium), with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key) (NVD).

The vulnerability allows any authenticated users to retrieve other users' account addresses, potentially exposing sensitive user information. This unauthorized access to user data represents a significant privacy concern for websites using the affected plugin versions (WPScan).

The vulnerability can be exploited by an authenticated user (subscriber level or higher) who can execute specific AJAX actions. A proof of concept exists demonstrating how the vulnerability can be exploited using the browser's developer console when logged in as a subscriber (WPScan).

The vulnerability has been patched in version 8.2.1 of the WP Customer Area plugin. Site administrators are strongly advised to update to this version or later to protect against unauthorized access to user data (WPScan).