The Download Panel WordPress plugin contains a missing capability check in its AJAX handler, the dlpn_save_settings() function. This flaw allows any authenticated user with at least Subscriber-level access to invoke the wp_ajax_save_settings action and arbitrarily alter plugin settings, such as display text, download links, and button appearance. The vulnerability is a classic example of CWE‑862, a missing authorization weakness, and while it does not permit code execution, it can be used to deface a site or redirect users.

The flaw exists in all releases of the Download Panel plugin up to and including version 1.3.3. The plugin is distributed by arkadiykilesso (Biggiko Team) and is commonly installed on WordPress sites that require a download panel feature. Any site running one of the affected versions is susceptible; newer releases beyond 1.3.3 have corrected the oversight.

The vulnerability scores a moderate CVSS of 4.3, with an EPSS below 1%, indicating a low exploitation probability at the time of analysis. It is not listed in CISA's KEV catalog. Because the attack vector requires authentication, an attacker only needs to be logged into the WordPress instance with Subscriber or higher privileges. Once authenticated, the attacker can send a crafted AJAX request to the vulnerable endpoint and manipulate the plugin’s configuration without further escalation.