CVE-2024-0710: 
WordPress vulnerability analysis and mitigation

The GP Unique ID plugin for WordPress (versions up to and including 1.5.5) contains a vulnerability that allows unauthenticated attackers to manipulate unique ID generation during form submissions. The vulnerability was discovered by Karl Emil Nikka of Nikka Systems and was publicly disclosed on April 10, 2024, with CVE identifier CVE-2024-0710. The issue has been assigned a CVSS score of 5.3 (Medium) (Wordfence).

The vulnerability stems from insufficient input validation in the plugin's form submission handling. When a form containing a Unique ID field is submitted, the plugin only assigns a new unique ID if the field is empty. This implementation flaw allows attackers to bypass the intended unique ID generation by submitting a form with a pre-filled unique ID field value (GitHub).

The vulnerability can lead to a loss of integrity in cases where the ID's uniqueness is relied upon in security-specific contexts. Attackers can set custom unique IDs that don't follow the required syntax, break sequential ordering, bypass randomization requirements, or reuse IDs already assigned to other entries (GitHub).

The vulnerability can be exploited by unauthenticated attackers through form submissions. No special privileges or complex attack vectors are required - an attacker only needs to submit a form with a manipulated unique ID value (Wordfence).

The vulnerability has been patched in version 1.5.6 of the GP Unique ID plugin, released on April 9, 2024. Site administrators should update to the patched version and verify that previous submissions haven't been tampered with (GitHub).