Multicollab WordPress Plugin Missing Authorization Vulnerability in Commenting Feature

A vulnerability exists in the Multicollab: Content Team Collaboration and Editorial Workflow plugin for WordPress, in all versions through 5.2. The issue arises from a missing capability check in the 'cf_add_comment' function, allowing authenticated attackers with Subscriber-level access and above to add comments to any collaboration. This unauthorized data modification could disrupt editorial workflows or collaboration processes.

Impact

Exploitation of this vulnerability allows for unauthorized addition of comments to collaborations, potentially disrupting content management and editorial workflows.

Remediation

Users are advised to update the plugin to version 5.3 or a newer patched version.