CVE-2024-35727: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was identified in the Extra Product Options for WooCommerce plugin, affecting versions through 3.0.6. The vulnerability was discovered by Abdi Pranata and was reported on November 27, 2023, with public disclosure occurring on June 6, 2024 (Patchstack).

The vulnerability is classified as a Broken Access Control issue (CWE-862) related to missing authorization checks. It received varying CVSS v3.1 scores: an 8.8 HIGH severity rating from NIST (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and a 4.3 MEDIUM severity rating from Patchstack (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) (NVD).

The vulnerability allows unprivileged users to execute certain higher privileged actions due to missing authorization, authentication, or nonce token checks. The specific impact varies case by case, though Patchstack has classified it as having a low severity impact and considers it unlikely to be exploited (Patchstack).

The vulnerability requires Subscriber level privileges to exploit. While specific exploit details are not publicly disclosed, the attack vector is network-accessible with low attack complexity and requires low privileges (Patchstack).

Users are advised to update to version 3.0.7 or later to remediate the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).