The Lafka Plugin for WordPress contains a missing capability check on the lafka_options_upload AJAX handler. Any authenticated user with subscriber-level access and above can invoke this endpoint and update theme options that override the site configuration. This privilege escalation allows an attacker to alter the appearance and behavior of the website, potentially injecting malicious content or causing defacement without administrator rights.

AlThemist’s Lafka Plugin versions up to and including 7.1.0 installed on WordPress sites are affected, with the vulnerability present in all earlier releases.

The CVSS score of 4.3 signifies moderate severity. The EPSS score below 1% indicates a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated WordPress login with subscriber or higher privileges and direct access to the vulnerable AJAX endpoint.