CVE-2024-1095: 
WordPress vulnerability analysis and mitigation

The Build & Control Block Patterns – Boost up Gutenberg Editor plugin for WordPress contains a vulnerability (CVE-2024-1095) related to unauthorized access of data. The vulnerability affects all versions up to and including 1.3.5.4, discovered and disclosed on March 4, 2024. The issue stems from a missing capability check on the settings_export() function (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The weakness is categorized as CWE-862 (Missing Authorization), indicating a fundamental security control issue in the authorization mechanism (NVD).

The vulnerability allows unauthenticated attackers to export the plugin's settings, potentially exposing sensitive configuration data. The impact is primarily focused on confidentiality with no direct effect on integrity or availability of the system (NVD).

The vulnerability is exploitable by unauthenticated attackers over the network, requiring low attack complexity and no user interaction. The attack vector is accessible remotely, making it relatively straightforward to exploit (NVD).

Users should upgrade to a version newer than 1.3.5.4 if available. The vulnerability was identified in the settings_export() function located in the SettingsPage.php file (NVD).