AnnunciFunebri Impresa WordPress Plugin Data Modification Vulnerability

A vulnerability exists in the AnnunciFunebri Impresa WordPress plugin, all versions through 4.7.0, allowing authenticated users with Subscriber-level access or higher to delete all plugin options. This is due to a missing capability check in the 'annfu_reset_options()' function, which enables the unauthorized removal of data and resets the plugin to its default state.

Impact

Exploitation of this vulnerability allows for arbitrary deletion of plugin options, potentially disrupting the functionality of the AnnunciFunebri Impresa plugin by resetting its configuration.

Reproduction

To reproduce this vulnerability, an authenticated user with Subscriber-level access or higher can trigger the 'annfu_reset_options()' function, which lacks proper authorization checks. This can be done by sending a request that includes the '_reset' parameter, prompting the function to delete all 29 plugin options.