CVE-2024-3711: 
WordPress vulnerability analysis and mitigation

The Brizy – Page Builder plugin for WordPress contains a vulnerability (CVE-2024-3711) related to unauthorized plugin setting updates due to missing capability checks. The vulnerability affects all versions up to and including 2.4.43, and was discovered in functions action_request_disable, action_change_template, and action_request_enable (NVD).

The vulnerability stems from missing capability checks in three key functions: action_request_disable, action_change_template, and action_request_enable. This security flaw has been assigned a CVSS v3.1 Base Score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The vulnerability is classified as CWE-862 (Missing Authorization) (NVD).

The vulnerability allows authenticated attackers with contributor access or above to enable/disable the Brizy editor and modify the template used without proper authorization. This could lead to unauthorized changes to the website's structure and appearance (NVD).

The vulnerability requires an authenticated user with at least contributor-level access to exploit. The attack complexity is considered low, requiring no user interaction to execute (NVD).

Users should upgrade to a version newer than 2.4.43 to address this vulnerability. The fix involves implementing proper capability checks for the affected functions (NVD).