The Bucketlister WordPress Plugin Missing Authorization Vulnerability Allowing Unauthorized Data Modification

A vulnerability exists in the Bucketlister plugin for WordPress, in all versions through 0.1.5, due to a lack of proper capability checks in the bucketlister_do_admin_ajax() function. This flaw enables authenticated attackers with Subscriber-level access and higher to add, delete, or modify any bucket list items.

Impact

Exploitation of this vulnerability allows for unauthorized users to alter bucket list items, potentially leading to misuse of the plugin's functionality or disruption of service.