NitroPack WordPress Plugin Missing Authorization Vulnerability in Transient Update

A vulnerability exists in the NitroPack plugin for WordPress, allowing authenticated attackers with subscriber access or higher to update arbitrary transients. This issue arises from a missing capability check in the nitropack_rml_notification function, present in all versions through 1.17.0. The vulnerability is limited to updating transients with integer values.

Impact

Exploitation of this vulnerability allows for unauthorized modification of transients, which could potentially be used to manipulate plugin or theme behavior that relies on transient data.

Remediation

Users are advised to update the NitroPack plugin to version 1.17.6 or a newer patched version.