GSheet For Woo Importer Missing Authorization Vulnerability in WordPress

A vulnerability exists in the GSheet For Woo Importer plugin for WordPress, all versions through 2.3.1, due to a lack of proper capability checks in the process_ajax_restore_action() function. This flaw allows authenticated attackers with Subscriber-level access or higher to delete the plugin's Google Sheets API token and configuration options, leading to unauthorized data loss.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of the Google Sheets API token and configuration options from the affected WordPress site.

Remediation

Users are advised to update the GSheet For Woo Importer plugin to version 2.4.1 or a newer patched version.