CVE-2024-23503: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in WPManageNinja LLC's Ninja Tables WordPress plugin, affecting versions through 5.0.6. The vulnerability was publicly disclosed on January 19, 2024, and was assigned CVE-2024-23503. This security issue specifically impacts the table data access functionality of the plugin (Patchstack).

The vulnerability stems from a missing capability check in the dragAndDropExport() function, which creates a broken access control scenario. The issue has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified under CWE-862 (Missing Authorization) (WPScan, Patchstack).

The vulnerability allows authenticated users with contributor-level access and above to export table data, which should only be accessible to administrators or users specifically assigned to access the plugin feature. This represents a breach in the intended access control mechanisms of the plugin (WPScan).

The vulnerability requires an authenticated user with at least contributor-level privileges to exploit. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited in the wild (Patchstack).

The vulnerability has been patched in version 5.0.7 of the Ninja Tables plugin. Users are advised to update to version 5.0.7 or later to remediate this security issue (Patchstack).