Traffic Monitor WordPress Plugin Missing Authorization Vulnerability in Bot Logging Feature

A vulnerability exists in the Traffic Monitor plugin for WordPress, all versions through 3.2.2, allowing unauthorized data modification. The issue arises from a lack of capability checks in the tfcm_maybe_set_bot_flags() function, enabling unauthenticated attackers to disable bot logging.

Impact

Exploitation of this vulnerability allows for unauthorized changes to plugin settings, specifically disabling bot logging, which could be misused to manipulate traffic analytics or bot detection features.

Remediation

Users are advised to update the Traffic Monitor plugin to version 3.2.3 or a newer patched version.