The Features WordPress plugin contains a missing capability check on the "features_revert_option" AJAX endpoint available in all releases up to and including 0.0.2. This flaw permits any authenticated user with a Subscriber role or higher to invoke the endpoint and revert plugin options without proper authorization. The weakness is a classic Missing Authorization error, classified as CWE‑862, resulting in an integrity violation of the site’s configuration.

The vulnerability exists in all klicher Features WordPress plugin releases up to version 0.0.2. Websites that have not upgraded beyond that version and have Subscriber (or higher) accounts are at risk.

The CVSS score of 4.3 indicates low severity, and the EPSS score of less than 1% shows a very low probability of exploitation. The flaw is not listed in CISA's KEV catalog, implying no widespread exploitation has been reported. An attacker needs only a valid WordPress login with Subscriber or higher permissions and the ability to call the AJAX endpoint; the exploitation consists of sending a request that triggers the revert action.