The DominoKit WordPress plugin contains a missing capability check on its wp_ajax_nopriv_dominokit_option_admin_action AJAX endpoint. This flaw allows attackers who are not logged in to submit requests that change the plugin’s configuration values. The vulnerability is a classic example of CWE‑862, whereby bypassing an authorization check grants unauthenticated users the ability to modify protected data. Such unauthorized changes could be leveraged to alter site behavior, disable security features, or create a foothold for more sophisticated attacks.

All installations of DominoKit plugin version 1.1.0 or earlier on WordPress sites are affected. The flaw exists in the plugin’s AJAX handling code and is not mitigated by WordPress’s core security features. Sites that deploy DominoKit and have not updated past 1.1.0 are therefore exposed.

The CVSS score for the issue is 5.3, indicating moderate severity. The EPSS score is less than 1%, suggesting a very low exploitation probability in the current threat landscape. This vulnerability is not listed in the CISA KEV catalog. The attack vector is unauthenticated via an exposed AJAX endpoint; an attacker only needs to craft a request to the endpoint to modify settings. Because the flaw allows change of configuration values, it can be used in concert with other weaknesses to widen the attack surface or facilitate further compromise.