CVE-2024-0780: 
WordPress vulnerability analysis and mitigation

The Enjoy Social Feed WordPress plugin through version 6.2.2 contains a security vulnerability related to database reset functionality. The vulnerability was discovered and publicly disclosed on February 20, 2024, affecting the plugin 'enjoy-instagram-instagram-responsive-images-gallery-and-carousel'. The issue was identified by security researcher Erwan LR from WPScan (WPScan).

The vulnerability stems from a lack of proper authorization controls when resetting the plugin's database. It has been assigned CVE-2024-0780 and received a CVSS score of 6.5 (medium severity). The vulnerability is classified as a Broken Access Control issue (OWASP Top 10 A5) and is specifically categorized under CWE-862 (WPScan).

The vulnerability allows any authenticated user, including those with minimal privileges such as subscribers, to reset the plugin's database. This could potentially lead to data loss or disruption of the plugin's functionality (CVE Mitre).

The vulnerability can be exploited by logging in as a subscriber and accessing the Diagnostic tab of the plugin at '/wp-admin/admin.php?page=enjoyinstagram_plugin_options&tab=diagnostic'. From there, an attacker can click on the re-install database button at the bottom to trigger the database reset (WPScan).

As of the vulnerability disclosure, there is no known fix available for this security issue. Website administrators using the affected plugin versions should consider implementing additional access controls or temporarily disabling the plugin until a patch is released (WPScan).