Employee Spotlight WordPress Plugin Missing Authorization Vulnerability in Tracking Opt-In/Out Modification

A vulnerability exists in the Employee Spotlight WordPress plugin, specifically in the Team Member Showcase & Meet the Team version 5.1.3 and prior. The issue arises from a lack of proper authorization validation in the 'employee_spotlight_check_optin()' function. This flaw allows authenticated attackers with Subscriber-level access and above to unauthorizedly modify tracking settings, enabling or disabling tracking options.

Impact

Exploitation of this vulnerability allows for unauthorized modification of tracking settings, potentially leading to misuse of tracking opt-in or opt-out preferences.

Remediation

Users can update to version 5.1.4 or a newer patched version to address this vulnerability.