The Check Plagiarism plugin for WordPress contains a missing capability check on the chk_plag_mine_plugin_wpse10500_admin_action() function. Because the access control guard is omitted, any authenticated user with Subscriber or higher privileges can invoke the function and update the plugin’s API key. This flaw maps to CWE‑862 and permits the attacker to change critical configuration without authorization, potentially enabling further misuse or service interruption.

This issue affects the plagiarismchecker Check Plagiarism WordPress plugin, versions 1.x through 2.0 inclusive. WordPress sites that have installed any of these older releases are susceptible. No other products or platforms are listed as affected.

The CVSS score of 4.3 indicates moderate risk, while the EPSS score of <1% suggests a low probability of exploitation in the wild. The flaw is not included in the CISA KEV list. An attacker must already possess a valid subscriber account, but such accounts are common on multi‑user WordPress installations. Once authenticated, the exploitation path is straightforward: the attacker calls the vulnerable admin action and replaces the API key.