CVE-2024-31281: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in the WordPress Church Admin plugin (church-admin) affecting versions through 4.1.6. The vulnerability was discovered by researcher Peng Zhou and was reported on February 16, 2024, with public disclosure occurring on April 5, 2024. The vulnerability allows for exploiting incorrectly configured access control security levels (Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 base score of 6.3 (Medium). The vulnerability vector is described as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, indicating network accessibility, low attack complexity, and requiring low privileges with no user interaction. The vulnerability affects the access control mechanisms within the plugin (Patchstack).

The vulnerability allows unprivileged users to execute certain higher privileged actions due to missing authorization, authentication, or nonce token checks. This broken access control issue has been confirmed to be actively exploited in the wild (Patchstack).

The vulnerability requires a low level of privilege (Subscriber) to exploit and is known to be actively exploited in the wild. The moderate CVSS score of 6.3 indicates that exploitation is expected to continue (Patchstack).

Users are advised to update to version 4.1.7 or later to resolve the vulnerability. For users of Patchstack, a virtual patch has been issued to mitigate this issue by blocking potential attacks until the update can be applied. Additionally, Patchstack users can enable auto-update functionality for vulnerable plugins (Patchstack).