WP Meta SEO Missing Authorization Vulnerability in Options Update

A vulnerability exists in the WP Meta SEO plugin for WordPress, specifically in versions through 4.5.3. The issue arises from a missing capability check in the 'wpmsGGSaveInformation' function, allowing authenticated attackers with subscriber-level access to unauthorizedly update Google Analytics options managed by the plugin. This vulnerability stems from the plugin's reliance on nonce checks for access control, with the nonce being available to all authenticated users, regardless of their role.

Impact

Exploitation of this vulnerability allows for unauthorized updates to Google Analytics options in the WP Meta SEO plugin, potentially leading to misconfigured analytics tracking or data manipulation.

Remediation

Users can update to WP Meta SEO version 4.5.4 or a newer patched version to address this vulnerability.