CVE-2024-33558: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability (CVE-2024-33558) was identified in 8theme XStore Core WordPress plugin, affecting versions up to 5.3.5. The vulnerability was discovered by Rafie Muhammad and publicly disclosed on April 25, 2024. The issue affects the et-core-plugin plugin for WordPress, making it possible for authenticated users with subscriber-level access and above to perform unauthorized actions (Patchstack, WPScan).

The vulnerability is classified as a Missing Authorization (CWE-862) issue with a CVSS v3.1 base score of 6.5 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability stems from the plugin not properly restricting which files can be downloaded, allowing for arbitrary file download capabilities (Patchstack).

The vulnerability allows authenticated attackers with subscriber-level access or higher to download arbitrary files from the affected WordPress installation. This could potentially expose sensitive information, including critical configuration files such as wp-config.php, which typically contains database credentials and other sensitive configuration details (WPScan).

The vulnerability requires an authenticated user with at least subscriber-level privileges to exploit. The attack complexity is considered low, requiring no user interaction to execute (Patchstack).

Website administrators are advised to update to XStore Core version 5.3.9 or later, which contains the fix for this vulnerability. The issue is considered high priority and should be addressed immediately to prevent potential exploitation (Patchstack).