CVE-2024-4788: 
WordPress vulnerability analysis and mitigation

The Boostify Header Footer Builder for Elementor plugin for WordPress contains a vulnerability (CVE-2024-4788) related to unauthorized modification of data. The vulnerability exists in all versions up to and including 1.3.3 due to a missing capability check on the create_bhf_post function. This security issue was disclosed on June 5, 2024 (NVD).

The vulnerability stems from a missing capability check in the create_bhf_post function, which allows authenticated users with subscriber-level access and above to create pages or posts with arbitrary content. The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating network accessibility, low attack complexity, and required low privileges (Wordfence).

The vulnerability allows authenticated attackers with subscriber-level access or higher to create pages or posts with arbitrary content on the affected WordPress sites. This could potentially lead to unauthorized content modification and compromise of website integrity (NVD).

The vulnerability requires an authenticated user with at least subscriber-level access to exploit. The attack complexity is considered low, and no user interaction is required for exploitation (NVD).

Website administrators should update the Boostify Header Footer Builder for Elementor plugin to a version newer than 1.3.3 to address this vulnerability. A patch has been made available in the WordPress plugin repository (WordPress Plugin).