CVE-2024-43998: 
WordPress 5FOqC0

A Missing Authorization vulnerability was discovered in WebsiteinWP Blogpoet WordPress theme affecting versions through 1.0.3. The vulnerability was disclosed on November 1, 2024, and received a CVSS v3.1 base score of 9.8 (CRITICAL) from NIST NVD, while Patchstack assigned it a CVSS score of 6.5 (MEDIUM) (NVD, Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization) and involves functionality not properly constrained by Access Control Lists (ACLs). The issue allows unauthenticated users to access functionality that should be restricted. The vulnerability was discovered by Fariq Fadillah Gusti Insani and reported on August 6, 2024 (Patchstack).

This broken access control vulnerability could allow unprivileged users to execute certain higher privileged actions. The severity of the vulnerability is reflected in its CVSS v3.1 scores, with NIST rating it as Critical (9.8) indicating potential for high impact on confidentiality, integrity, and availability (NVD).

Users are advised to update to Blogpoet version 1.0.4 or later to resolve the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to a fixed version (Patchstack).