CVE-2024-35669: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in Bowo Debug Log Manager WordPress plugin affecting versions through 2.3.1. The vulnerability was identified on June 9, 2024, and was assigned CVE-2024-35669. The issue received a CVSS v3.1 base score of 8.8 (HIGH) from NIST NVD and 4.3 (MEDIUM) from Patchstack (Patchstack Advisory).

The vulnerability is classified as CWE-862 (Missing Authorization) and represents a broken access control issue. The security flaw stems from missing authorization checks that could allow unprivileged users to execute higher privileged actions. The vulnerability affects the toggle_debugging functionality in the plugin (Patchstack Advisory).

The vulnerability has been assessed with varying severity levels, with NIST NVD rating it as HIGH (CVSS 8.8) indicating potential significant impact, while Patchstack rates it as MEDIUM (CVSS 4.3). The broken access control issue could allow unprivileged users to perform actions that should be restricted to users with higher privileges (Patchstack Advisory).

The vulnerability requires a Subscriber level privilege for exploitation. It was initially reported on January 14, 2024, by security researcher Majed Refaea (Patchstack Advisory).

The vulnerability has been fixed in version 2.3.2 of the Debug Log Manager plugin. Users are advised to update to this version or later to remediate the security issue. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack Advisory).