CVE-2024-35717: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in A WP Life Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow WordPress plugin affecting versions through 1.3.9. The vulnerability was reported on February 7, 2024, and publicly disclosed on June 6, 2024 (Patchstack).

The vulnerability is classified as a Missing Authorization (CWE-862) issue, which represents a broken access control vulnerability. The severity assessment varies between sources, with NVD assigning a CVSS v3.1 Base Score of 8.8 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while Patchstack rates it at 4.3 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability could allow an unprivileged user to execute certain higher privileged actions due to missing authorization, authentication, or nonce token checks (Patchstack).

The vulnerability requires a low attack complexity and network access, with only low privileges needed for exploitation. No user interaction is required for the attack to succeed (NVD).

Users are advised to update to version 1.4.0 or later of the Media Slider plugin to remediate this vulnerability (Patchstack).