CVE-2024-35661: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability (CVE-2024-35661) was identified in SoftLab Upload Fields for WPForms affecting versions through 1.0.2. The vulnerability was discovered by Majed Refaea and publicly disclosed on June 3, 2024. This security issue affects the WordPress plugin Upload Fields for WPForms and represents a broken access control vulnerability (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) by NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, while Patchstack assessed it with a CVSS score of 5.3 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The vulnerability is classified as CWE-862 (Missing Authorization) (NVD).

The vulnerability allows for broken access control, which means unprivileged users could potentially execute certain higher privileged actions. While specific impact details vary case by case, the high CVSS score from NIST indicates potential for significant security implications if exploited (Patchstack).

The vulnerability can be exploited by unauthenticated attackers, requiring no user interaction for exploitation. The attack complexity is considered low, making it relatively straightforward to exploit (NVD).

Currently, no official fix is available for this vulnerability. However, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until an official fix becomes available. Website owners using the affected plugin versions are advised to implement the Patchstack mitigation (Patchstack).