CVE-2024-30463: 
WordPress vulnerability analysis and mitigation

The BEAR WordPress plugin contains a Missing Authorization vulnerability (CVE-2024-30463) affecting versions up to and including 1.1.4.3. The vulnerability was discovered by Dhabaleshwar Das and publicly disclosed on March 28, 2024. This security issue affects the plugin's access control mechanisms, potentially allowing unauthorized modifications to page data (Patchstack, WPScan).

The vulnerability stems from a missing capability check in the woobe_update_page_field() function, which could allow unauthenticated attackers to modify page details. The issue has been assigned a CVSS v3.1 score of 4.3 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. The vulnerability is classified as CWE-862 (Missing Authorization) (Patchstack).

The vulnerability allows unauthenticated attackers to perform unauthorized modifications to page details within WordPress installations running the affected BEAR plugin versions. This represents a broken access control issue that could lead to unauthorized content modifications (WPScan).

The vulnerability requires no authentication and can be exploited remotely, though it does require user interaction. The relatively low CVSS score of 4.3 suggests limited impact potential (Patchstack).

Users are advised to update to BEAR plugin version 1.1.4.4 or later, which contains the fix for this vulnerability. Patchstack has also issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).