BWL Advanced FAQ Manager Missing Authorization Vulnerability Allowing Arbitrary Options Update

A vulnerability exists in the BWL Advanced FAQ Manager plugin for WordPress, in all versions through 2.1.4. The issue arises from a lack of proper capability checks on the 'baf_set_notice_status' AJAX action, allowing authenticated attackers with Subscriber-level access and above to unauthorizedly modify option values. This could lead to a denial-of-service condition by causing errors on the site or by manipulating options related to user registration.

Impact

Exploitation of this vulnerability could result in unauthorized data modification, potentially causing errors that disrupt normal site operations and access for legitimate users.

Remediation

Users are advised to update the BWL Advanced FAQ Manager plugin to version 2.1.5 or a newer patched version.