CVE-2024-22151: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in the WordPress plugin 'Import and export users and customers' affecting versions up to 1.24.6. The vulnerability was reported on December 15, 2023, and publicly disclosed on January 16, 2024 (Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 score of 5.3 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The issue stems from missing authorization checks that could allow unprivileged users to execute certain higher privileged actions (Patchstack).

The vulnerability has been assessed as having a low severity impact. While it allows unauthorized access to certain functions, the specific impact is limited to integrity-related issues without affecting confidentiality or availability (Patchstack).

The vulnerability can be exploited by unauthenticated users, though it is considered unlikely to be exploited due to its low severity impact (Patchstack).

The vulnerability has been fixed in version 1.24.7 of the plugin. Users are advised to update to this version or later to resolve the security issue. Additionally, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).