TokenICO WordPress Plugin Missing Authentication Vulnerability in Presale Update Function

A vulnerability exists in the TokenICO WordPress plugin, specifically in the Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO category, all versions through 2.4.6. The issue arises from missing authentication and capability checks in the 'createSaleRecord' function, allowing unauthenticated and unauthorized users to modify presale data, particularly by manipulating presale counters.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in presale data, allowing attackers to manipulate presale counters without authentication.