Pure WC Variation Swatches WordPress Plugin Missing Authorization Vulnerability in Settings Update

A vulnerability exists in the Pure WC Variation Swatches WordPress plugin, affecting versions through 1.1.7. The issue arises because the plugin lacks proper authorization checks when updating settings. This flaw could enable any authenticated user to modify the settings.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in the plugin's settings by any authenticated user.

Reproduction

To reproduce this vulnerability, send a POST request to 'wp-admin/admin-ajax.php' with the action 'tpwvs_update_settings'. Include the settings data for 'tpwvs_general', 'tpwvs_shop', or 'tpwvs_style' in the request. The absence of an authorization check will allow the settings to be updated without proper permissions.