CVE-2024-9223: 
WordPress vulnerability analysis and mitigation

The WPDash Notes plugin for WordPress contains a vulnerability (CVE-2024-9223) related to unauthorized access of data due to a missing capability check on the 'wp_ajax_post_it_list_comment' function. This vulnerability affects all versions up to and including 1.3.5. The issue was discovered and reported by Wordfence, with a partial patch released in version 1.3.5 (NVD).

The vulnerability stems from a missing authorization check in the 'wp_ajax_post_it_list_comment' function. It has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The weakness is categorized as CWE-862 (Missing Authorization) (NVD).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to view comments on any post, including private and password-protected posts, as well as pending and draft posts if they were previously published (NVD).

The vulnerability requires an authenticated user with at least Subscriber-level access to exploit. The attack complexity is considered low, requiring no user interaction to execute (NVD).

A partial patch has been released in version 1.3.5 of the WPDash Notes plugin. Users are advised to update to the latest version to mitigate this vulnerability (NVD).