CAOS Host Google Analytics Locally Missing Authorization Vulnerability in WordPress Plugin

A vulnerability exists in the CAOS | Host Google Analytics Locally WordPress plugin, specifically in versions through 4.7.14. The issue arises from a missing capability check in the 'update_settings' function, allowing unauthenticated attackers to modify plugin settings. This unauthorized data modification could lead to various impacts, depending on the nature of the changed settings.

Impact

Exploitation of this vulnerability allows for unauthorized changes to the plugin's settings, which could disrupt the intended functionality of the plugin or the website's analytics tracking.

Reproduction

To reproduce this vulnerability, an unauthenticated user can send a request to the WordPress site with the 'action' parameter set to 'caos-update'. This request will bypass the missing capability check and allow the attacker to modify plugin settings.

Remediation

Users are advised to update the CAOS | Host Google Analytics Locally plugin to version 4.7.15 or later, where this vulnerability has been patched.