An unauthenticated remote attacker can manipulate site content in the WPGSI: Spreadsheet Integration plugin for WordPress due to a missing capability check and insecure token validation.

The vulnerability stems from missing authorization (CWE-862) within the REST API endpoints, specifically the wpgsi_callBackFuncAccept and wpgsi_callBackFuncUpdate functions. These endpoints incorrectly utilize a permissive callback, allowing unauthenticated attackers to forge authentication tokens using easily enumerable information to perform unauthorized administrative actions.

The ability for an unauthenticated user to modify or delete WordPress posts and pages presents a significant threat to data integrity and site availability. Given the CVSS score of 7.5, this high severity flaw could lead to the unauthorized defacement of public-facing content or the destruction of critical business information.

Immediate Action: There is no specific patched version identified in the provided data, so administrators should immediately deactivate and remove the WPGSI: Spreadsheet Integration plugin until a secure update is verified from the developer.

Proactive Monitoring: Review WordPress access logs for any suspicious REST API requests originating from unauthorized IP addresses, particularly those targeting the wpgsi endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized access to the plugin specific REST API endpoints, effectively preventing exploitation of the insecure token validation mechanism.

Public Exploit Available: No (no confirmed public exploit or weaponized module identified).

This vulnerability represents a critical risk to WordPress environments using the affected plugin. Because the authentication mechanism is fundamentally flawed and allows for unauthorized data manipulation, immediate removal of the plugin is the only effective way to prevent exploitation until a verified security update is released by the vendor.