TokenICO WordPress Plugin Missing Authorization Vulnerability in Deployed Contract Update

A vulnerability exists in the TokenICO WordPress plugin, specifically in the Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO category, in versions through 2.4.6. The issue arises from a lack of proper capability checks in the 'saveDeployedContract' function, allowing authenticated attackers with Subscriber-level access and above to unauthorizedly modify data. Exploitation of this vulnerability enables overwriting of the WordPress option 'tokenico_deployed_contracts', potentially corrupting the displayed smart contract addresses.

Impact

Exploitation allows for unauthorized modification of smart contract address data, which could lead to the display of incorrect or malicious contract information.