CVE-2024-6836: 
WordPress vulnerability analysis and mitigation

The Funnel Builder for WordPress by FunnelKit plugin (versions up to 3.4.6) contains a vulnerability due to missing capability checks on multiple functions. This security issue was assigned CVE-2024-6836 and was discovered by Wordfence (Wordfence Advisory).

The vulnerability stems from missing authorization checks on multiple functions within the plugin. This security flaw has been classified as CWE-862 (Missing Authorization) with a CVSS v3.1 base score of 4.3 (MEDIUM) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (NVD).

The vulnerability allows authenticated attackers with Contributor-level access or higher to modify multiple plugin settings without proper authorization. This includes the ability to update templates, designs, checkouts, and other plugin settings (NVD).

The vulnerability requires an authenticated user with at least Contributor-level access to exploit. The attack complexity is considered low, requiring no user interaction to execute (Wordfence Advisory).

The vulnerability has been patched in version 3.4.7 of the Funnel Builder plugin. Users are advised to update to this version or later to protect against potential exploitation (WordPress Patch).