CVE-2024-47362: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability (CVE-2024-47362) was discovered in WPChill Strong Testimonials WordPress plugin, affecting versions up to 3.1.16. The vulnerability was reported on September 30, 2024, and involves broken access control security levels (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization) and has received varying CVSS v3.1 severity ratings. The National Institute of Standards and Technology (NIST) assessed it with a HIGH severity score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while Patchstack rated it as MEDIUM with a score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) (NVD).

The vulnerability allows exploiting incorrectly configured access control security levels, potentially enabling unauthorized access to protected functionality. The issue requires a low privilege level for exploitation and can be accessed remotely (NVD).

The vulnerability requires a low attack complexity and can be exploited by an authenticated user with subscriber-level privileges. No user interaction is needed for exploitation (Patchstack).

The vulnerability has been patched in version 3.1.17 of the Strong Testimonials plugin. Users are advised to update to this version or later to resolve the security issue (Patchstack).