CVE-2024-5665: 
WordPress vulnerability analysis and mitigation

CVE-2024-5665 affects the Login/Signup Popup (Inline Form + Woocommerce) plugin for WordPress versions 2.7.1 to 2.7.2. The vulnerability was discovered and disclosed on June 6, 2024, and involves unauthorized access to data due to a missing capability check in the 'export_settings' function (Wordfence Advisory).

The vulnerability is classified as a Missing Authorization issue (CWE-862) with a CVSS v3.1 Base Score of 4.3 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The security flaw exists in the 'export_settings' function where proper capability checks are absent, allowing authenticated users with Subscriber-level access or higher to access unauthorized data (NVD).

The vulnerability allows authenticated attackers with Subscriber-level access and above to read arbitrary options on affected WordPress sites. This unauthorized access to data could potentially expose sensitive configuration information (Wordfence Advisory).

The vulnerability requires an authenticated user with at least Subscriber-level access to exploit. The attack complexity is considered Low, requiring no user interaction to execute (NVD).

A patch has been released to address this vulnerability. Site administrators should upgrade to a version newer than 2.7.2 to protect against this security issue (WordPress Plugin Repository).