CVE-2024-1120: 
WordPress vulnerability analysis and mitigation

The vulnerability (CVE-2024-1120) affects two WordPress plugins: NextMove Lite – Thank You Page for WooCommerce and Finale Lite – Sales Countdown Timer & Discount for WooCommerce, in versions up to and including 2.17.0. The vulnerability was discovered by Francesco Carlucci and was publicly disclosed on February 29, 2024 (Wordfence Intel).

The vulnerability is classified as a Missing Authorization vulnerability with a CVSS score of 5.3 (Medium), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The issue stems from a missing capability check in the download_tools_settings() function, which allows unauthorized access to system information (Wordfence Intel).

The vulnerability allows unauthenticated attackers to export system information that could potentially be used to aid in further attacks against the affected system (Wordfence Intel).

The vulnerability can be exploited by unauthenticated attackers, requiring no special privileges or user interaction to access sensitive system information (Wordfence Intel).

For the Finale Lite plugin, users should update to version 2.18.0 or newer. For the NextMove Lite plugin, users should update to version 2.18.1 or newer to patch the vulnerability (Wordfence Intel).