Simple User Capabilities WordPress Plugin Missing Authorization Vulnerability in AJAX Endpoint

A vulnerability exists in the Simple User Capabilities plugin for WordPress, all versions through 1.0, allowing unauthorized data modification. The issue arises from a missing capability check on the 'wp_ajax_nopriv_reset_capability' AJAX endpoint, enabling unauthenticated attackers to reset any user's capabilities.

Impact

Exploitation of this vulnerability allows unauthenticated users to reset the capabilities of any user, potentially leading to unauthorized access or privilege escalation.

Remediation

No known patch is available. It is recommended to uninstall the affected plugin and find a replacement.