A missing capability check in the Genolve AI plugin for WordPress allows authenticated users to perform unauthorized modifications to plugin settings and data.

The plugin fails to verify user permissions within the genolve_setOpt() function. This enables an authenticated user, regardless of their privilege level, to execute unauthorized actions and potentially alter plugin configurations.

With a CVSS score of 8.8, this vulnerability poses a severe threat. An attacker could potentially escalate privileges, modify site content, or disrupt service operations by manipulating plugin settings, resulting in unauthorized control over the affected WordPress environment.

Immediate Action: Update the Genolve plugin to the latest version to ensure appropriate capability checks are enforced.

Proactive Monitoring: Audit user activity logs for suspicious configuration changes or unexpected utilization of the genolve_setOpt() function by low-privileged accounts.

Compensating Controls: Implement strict role-based access control (RBAC) to limit the number of users capable of accessing plugin configuration interfaces.

Public Exploit Available: false

This vulnerability highlights the risk of insufficient authorization checks in plugins. It is highly recommended to update the software immediately and review existing user roles to minimize the exposure of administrative functions.