Vayu Blocks WordPress Plugin Missing Authorization Vulnerability Allows Unauthenticated Options Modification

A vulnerability exists in the Vayu Blocks Gutenberg Blocks for WordPress and WooCommerce plugin, specifically in versions 1.0.4 prior to 1.2.1. The issue arises from inadequate capability checks in the 'vayu_blocks_get_toggle_switch_values_callback' and 'vayu_blocks_save_toggle_switch_callback' functions. This flaw enables unauthenticated attackers to read plugin options and modify any option with a key ending in '_value'.

Impact

Exploitation of this vulnerability could lead to unauthorized access and modification of WordPress options, potentially allowing attackers to change settings or data within the affected site.

Remediation

Users are advised to update the Vayu Blocks plugin to version 1.2.2 or later.