CVE-2023-7268: 
WordPress vulnerability analysis and mitigation

The ArtPlacer Widget WordPress plugin before version 2.21.2 contains a vulnerability that was discovered and disclosed on June 28, 2024. The vulnerability affects the widget deletion functionality in the WordPress plugin ArtPlacer Widget (WPScan).

The vulnerability stems from a missing authorization check in the widget deletion functionality. This security flaw has been classified as a Broken Access Control issue (OWASP Top 10 A5) and is categorized under CWE-862. The vulnerability has received a CVSS 3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, indicating network accessibility, low attack complexity, and high impact on integrity (NVD).

The vulnerability allows any authenticated user, including those with low-privilege roles such as subscribers, to delete arbitrary widgets from the WordPress installation. This can lead to unauthorized modification of website content and potential disruption of website functionality (WPScan).

The vulnerability has been fixed in version 2.21.2 of the ArtPlacer Widget plugin. Users are strongly advised to update to this version or later to mitigate the security risk (WPScan).