Page & Post Notes WordPress Plugin Missing Authorization Vulnerability Allowing Unauthorized Note Modification

A vulnerability exists in the Page & Post Notes plugin for WordPress, specifically in versions through 1.3.4. The issue arises from a lack of proper capability checks in the 'yydev_notes_save_dashboard_data' function, allowing authenticated attackers with Subscriber-level access and above to unauthorizedly modify notes. This vulnerability was introduced in version 1.3.4 and has been patched in version 1.3.5.

Impact

Exploitation of this vulnerability allows for unauthorized modification or deletion of notes by authenticated users with Subscriber-level access or higher.

Remediation

Users can update to version 1.3.5 or a newer patched version to address this vulnerability.