CVE-2024-35716: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in the Copymatic – AI Content Writer & Generator WordPress plugin affecting versions up to 1.9. The vulnerability was identified and reported on February 20, 2024, and was assigned CVE-2024-35716. This security issue represents a broken access control vulnerability that affects the WordPress plugin's functionality (Patchstack).

The vulnerability has been assessed with multiple CVSS scores: NVD assigned a base score of 8.8 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while Patchstack rated it at 6.5 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. The vulnerability is classified as CWE-862 (Missing Authorization) and requires only Subscriber-level privileges to exploit (NVD).

The vulnerability could allow unprivileged users to execute certain higher privileged actions due to missing authorization, authentication, or nonce token checks. This could potentially lead to unauthorized access and control over protected functionality (Patchstack).

The vulnerability is considered moderately dangerous and is expected to become exploited. It requires Subscriber-level privileges, which is a relatively low barrier for exploitation (Patchstack).

The vulnerability has been fixed in version 2.0 of the plugin. Users are advised to update to version 2.0 or later immediately. For Patchstack users, a virtual patch has been issued to mitigate this issue by blocking potential attacks until the update to a fixed version can be completed (Patchstack).