CVE-2024-31368: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability has been identified in PenciDesign Soledad, affecting versions through 8.4.2. The vulnerability was discovered by Rafie Muhammad and was publicly disclosed on April 9, 2024. This security issue has been assigned CVE-2024-31368 and affects the WordPress Soledad theme (Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) with a CVSS v3.1 base score of 6.5 (Medium). The vulnerability vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, indicating that it can be exploited over the network with low attack complexity, requires no privileges or user interaction, and can result in low impact to both integrity and availability (Patchstack).

The vulnerability is considered highly dangerous and is expected to become mass exploited. It allows unprivileged users to execute certain higher privileged actions due to missing authorization, authentication, or nonce token checks (Patchstack).

The vulnerability can be exploited by unauthenticated users, making it particularly concerning. The attack vector is network-based, requiring low complexity to execute (Patchstack).

Users are advised to update to version 8.4.6 or later to resolve the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users can update to a fixed version (Patchstack).