The Quote Comments plugin contains missing authentication checks in the quotecomments_add_admin function, enabling any authenticated user with Subscriber privileges or higher to alter plugin options through the action parameter. This flaw grants attackers the ability to modify configuration values, affecting the site's presentation or behavior and potentially opening doors to additional vulnerabilities. The core issue is a loss of configuration integrity, as unauthorized users can change settings that should be protected.

WordPress sites running the Quote Comments plugin versions up to and including 3.0.0 from the vendor metodiew are affected. Versions beyond 3.0.0 are not known to be vulnerable. Site administrators should verify the installed version and upgrade if it falls within the vulnerable range.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% reflects a very low exploitation probability, and it is not listed in the CISA KEV catalog. Attackers require valid credentials with at least Subscriber level access and the ability to reach the WordPress admin interface. Once authenticated, they can perform arbitrary option updates by sending crafted requests to the plugin’s admin endpoint, as the code path bypasses capability checks.