Vimeo SimpleGallery Missing Authorization Vulnerability in WordPress

A vulnerability exists in the Vimeo SimpleGallery plugin for WordPress, in all versions through 0.2, due to missing authorization checks. This flaw allows authenticated users with Subscriber-level access and above to modify arbitrary plugin settings by exploiting the 'action' parameter. The issue arises from the 'vimeogallery_admin' function, which lacks proper authorization before allowing changes to plugin options.

Impact

Exploitation of this vulnerability could lead to unauthorized modification of plugin settings, potentially allowing attackers to alter how the gallery functions or is displayed.