Download Panel WordPress Plugin Missing Authorization Vulnerability Allows Arbitrary Settings Modification

A vulnerability exists in the Download Panel plugin for WordPress, in all versions through 1.3.3, allowing unauthorized modification of plugin settings. This issue arises from a missing capability check on the 'wp_ajax_save_settings' AJAX action, which enables authenticated attackers with Subscriber-level access and above to arbitrarily change settings such as display text, download links, button colors, and other visual customizations.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in plugin settings, allowing attackers to modify visual elements and functionality associated with the Download Panel plugin.