WP Dashboard Notes WordPress Plugin Post ID Vulnerability Allowing Note Updates by Contributors and Above

A vulnerability exists in the WP Dashboard Notes WordPress plugin in versions prior to 1.0.11. The issue arises because the plugin's wpdn_update_note AJAX action does not properly validate user access to the post_id parameter. This flaw enables users with a contributor role or higher to modify notes created by other users.

Impact

Exploitation of this vulnerability allows for unauthorized users with a contributor role or above to update private notes belonging to other users, potentially leading to information manipulation or disclosure.

Remediation

Users are advised to update the WP Dashboard Notes WordPress plugin to version 1.0.11 or later.