WP Online Contract Missing Authorization Vulnerability in WordPress Plugin

A vulnerability exists in the WP Online Contract plugin for WordPress, all versions through 5.1.4, due to a lack of proper capability checks in the json_import() and json_export() functions. This flaw allows unauthenticated attackers to import and export the plugin's settings, potentially leading to unauthorized modifications or data exposure.

Impact

Exploitation of this vulnerability could result in unauthorized access to the plugin's settings, allowing attackers to import or export configurations without authentication.