Webcake Landing Page Builder Missing Authorization Vulnerability in WordPress

A vulnerability exists in the Webcake – Landing Page Builder plugin for WordPress, in all versions through 1.1. The issue arises from a missing capability check on the 'webcake_save_config' AJAX endpoint, allowing authenticated attackers with Subscriber-level access and above to unauthorizedly modify the plugin's settings.

Impact

Exploitation of this vulnerability allows for unauthorized modification of the plugin's settings by authenticated users with Subscriber-level access or higher.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.