CVE-2023-7019: 
WordPress vulnerability analysis and mitigation

The LightStart – Maintenance Mode, Coming Soon and Landing Page Builder plugin for WordPress contains a vulnerability (CVE-2023-7019) that affects all versions up to and including 2.6.8. The vulnerability was discovered and reported by Wordfence, with the issue being a missing capability check on the insert_template function (NVD, WPScan).

The vulnerability is classified as a Missing Authorization issue (CWE-862) with a CVSS v3.1 Base Score of 4.3 (Medium). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating that it requires network access and low privileges to exploit, with no user interaction needed (NVD).

The vulnerability allows authenticated attackers with subscriber-level access or higher to modify page designs by exploiting the missing capability check in the insert_template function. This unauthorized modification of data could potentially affect the website's appearance and content (NVD).

The vulnerability has been patched in version 2.6.9 of the LightStart plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).