NitroPack WordPress Plugin Missing Authorization Vulnerability in AJAX Action

A vulnerability exists in the NitroPack plugin for WordPress, in all versions through 1.17.0, allowing unauthorized data modification. This issue arises from a missing capability check on the 'nitropack_dismiss_notice_forever' AJAX action. Authenticated attackers with subscriber-level access or higher can exploit this vulnerability to change arbitrary options to a fixed value of '1'. This could activate certain features, such as user registration, or alter options in a way that causes a denial-of-service condition.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in WordPress options, potentially activating features like user registration or causing a denial-of-service condition.

Remediation

Users are advised to update the NitroPack WordPress plugin to version 1.17.6 or a newer patched version.