CVE-2024-35659: 
WordPress vulnerability analysis and mitigation

The CVE-2024-35659 is an Authorization Bypass Through User-Controlled Key vulnerability affecting KiviCare WordPress plugin versions through 3.6.2. The vulnerability was discovered and reported on June 8, 2024, and is classified as an Insecure Direct Object References (IDOR) issue (Patchstack).

The vulnerability has received multiple CVSS v3.1 severity ratings: a HIGH severity score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) from NIST and a MEDIUM severity score of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) from Patchstack. The vulnerability is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key) (NVD).

The vulnerability could allow a malicious actor to bypass authorization and authentication mechanisms, potentially leading to unauthorized access to sensitive files, folders, or database interactions (Patchstack).

The vulnerability requires Patient-level privileges for exploitation, indicating a relatively low barrier to entry for potential attackers (Patchstack).

Users are advised to update to KiviCare version 3.6.7 or later to remediate this vulnerability. The security issue has been assessed as having a low severity impact and is considered unlikely to be exploited (Patchstack).