Felan Framework WordPress Plugin Missing Capability Check Vulnerability Allows Unauthenticated Plugin Management

A vulnerability exists in the Felan Framework plugin for WordPress, specifically in versions through 1.1.4. The issue arises from a missing capability check in the 'process_plugin_actions' function, which is triggered by an AJAX action. This flaw enables unauthenticated attackers to activate or deactivate any plugin on the site.

Impact

Exploitation of this vulnerability allows for unauthorized activation or deactivation of WordPress plugins, which could lead to a range of issues depending on the functionality of the manipulated plugins.

Remediation

Users are advised to update the Felan Framework WordPress plugin to version 1.1.5 or later.