WP Wallcreeper Missing Capability Check Vulnerability Allowing Unauthorized Cache Management

A vulnerability exists in the WP Wallcreeper plugin for WordPress, in all versions through 1.6.1. The issue arises from a lack of proper capability checks on the admin_notices hook, which allows authenticated attackers with Subscriber-level access or higher to unauthorizedly modify data. Specifically, these attackers can enable or disable caching, potentially disrupting site performance or functionality.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in cache management, allowing attackers to disrupt normal site operations by improperly managing cached content.