ConvertPlus WordPress Plugin Missing Authorization Vulnerability Allowing Denial-of-Service

A denial-of-service vulnerability has been identified in the ConvertPlus plugin for WordPress, affecting all versions through 3.5.30. The issue arises from a missing capability check on the 'cp_dismiss_notice' AJAX endpoint, allowing authenticated attackers with Subscriber-level access and above to unauthorizedly modify option values. This manipulation can create errors on the site, disrupting service for legitimate users, or alter specific settings, such as enabling registration.

Impact

Exploitation of this vulnerability can lead to unauthorized data modification, causing errors that disrupt normal site operations and potentially interfere with user registration processes.

Remediation

Users are advised to update the ConvertPlus plugin to version 3.5.31 or a newer patched version.