CVE-2024-2702: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in Olive Themes Olive One Click Demo Import plugin through version 1.1.1. The vulnerability was disclosed on March 20, 2024, and allows unauthorized users to import settings and data, which can ultimately lead to Cross-Site Scripting (XSS) attacks (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 8.2 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. The issue is classified as CWE-862 (Missing Authorization) and affects the plugin's functionality related to demo content importing (Patchstack).

The vulnerability allows unauthenticated attackers to import settings and data into WordPress installations running the affected plugin. This can lead to Cross-Site Scripting (XSS) attacks, potentially compromising the security of the affected websites (Patchstack).

The vulnerability is considered highly dangerous and expected to become mass exploited. It requires no authentication to exploit, making it particularly concerning for websites running vulnerable versions of the plugin (Patchstack).

Website administrators are advised to update to version 1.1.2 or later of the Olive One Click Demo Import plugin, which contains fixes for this vulnerability. Patchstack has also issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).