CVE-2024-31270: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in Repute InfoSystems ARForms Form Builder, affecting versions through 1.6.1. The vulnerability was discovered by researcher Yudistira Arya on January 9, 2024, and was publicly disclosed on April 5, 2024. The issue has been assigned CVE-2024-31270 and is classified as a broken access control vulnerability (Patchstack).

The vulnerability has been assessed with a CVSS v3.1 base score of 7.6 (High) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L. The issue is categorized under CWE-862 (Missing Authorization) and requires subscriber-level privileges to exploit (Patchstack).

This vulnerability is considered highly dangerous and is expected to become mass exploited. The broken access control issue could allow an unprivileged user to execute certain higher privileged actions, potentially compromising the security of the affected WordPress installations (Patchstack).

The vulnerability requires subscriber-level privileges to exploit and has been classified as having a high priority for patching. Attackers typically automate attacks against such security vulnerabilities to compromise websites before users have time to update (Patchstack).

The vulnerability has been fixed in version 1.6.2 of the ARForms Form Builder plugin. Users are strongly advised to update to version 1.6.2 or later immediately. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).