CVE-2024-0779: 
WordPress vulnerability analysis and mitigation

CVE-2024-0779 affects the WordPress plugin Enjoy Social Feed (enjoy-instagram-instagram-responsive-images-gallery-and-carousel) versions 6.2.2 and below. The vulnerability was discovered by Krzysztof Zając from CERT PL and was publicly disclosed on February 20, 2024. This security issue involves missing authorization controls in the plugin's functionality (WPScan).

The vulnerability is classified as a Missing Authorization vulnerability (CWE-862) with a CVSS score of 5.3 (Medium). The security flaw exists due to the absence of proper authorization checks and CSRF protection in various functions hooked to admin_init, which allows unauthenticated users to perform unauthorized actions. This falls under the OWASP Top 10 category A5: Broken Access Control (WPScan).

The vulnerability allows unauthenticated users to unlink arbitrary users' Instagram accounts from the WordPress installation. This can disrupt the functionality of the social media integration and potentially impact the website's content display (WPScan).

The vulnerability can be exploited by unauthenticated users by accessing a specific URL pattern: https://example.com/wp-admin/admin-post.php?action=enjoyinstagram-remove-user&user_id=[ID]&tab=users-settings, where [ID] represents the target user's ID (WPScan).

As of the vulnerability disclosure, there is no known fix available for this security issue. Website administrators using the affected plugin should consider implementing additional security measures or temporarily disabling the plugin until a patch is released (WPScan).