Shelf Planner WordPress Plugin Missing Authorization Vulnerability Allowing Unauthenticated Data Modification

A vulnerability exists in the Shelf Planner plugin for WordPress, in all versions through 2.7.0, allowing unauthorized data modification. This issue arises from a lack of proper capability checks on several REST API endpoints, enabling unauthenticated attackers to alter various plugin settings, including the ServerKey and LicenseKey.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in plugin settings, potentially allowing for misuse of the ServerKey and LicenseKey.