The Permalinks Cascade WordPress Plugin Missing Authorization Vulnerability

A missing authorization vulnerability has been identified in the Permalinks Cascade plugin for WordPress, affecting all versions through 2.2. The issue arises because the plugin's handleTPCAdminAjaxRequest function fails to properly verify user authorization for certain actions. This flaw allows authenticated attackers with subscriber-level access or higher to execute unauthorized administrative tasks, such as changing automatic pinging preferences and adjusting page exclusion settings.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in plugin settings, specifically regarding automatic pinging and page exclusions.