The vulnerability arises because the Zportals WordPress plugin prior to version 6.4.2 fails to perform capability or nonce verification on several AJAX actions. As a result, any user with a subscriber-level account can send authenticated requests to alter the plugin’s stored integration settings. This allows an attacker to change how the plugin interacts with external services, potentially enabling malicious configurations such as unauthorized data exfiltration, credential theft, or further privilege escalation within the WordPress environment. The impact is primarily integrity and availability of the plugin’s configuration, which could compromise overall site security. The weakness maps to CWE-862, a missing authorization flaw.

Zportals WordPress plugin versions older than 6.4.2, any WordPress installation that has the plugin enabled. The vendor is listed as unknown:zportals.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog, suggesting limited evidence of widespread exploitation. The likely attack vector is remote: an authenticated subscriber can trigger the vulnerable AJAX endpoints and modify plugin settings. No additional system compromise is required beyond the subscriber credentials. Because the plugin accepts the requests without nonce verification, the exploitation is straightforward if the attacker can obtain subscriber privileges, which may be achieved through social engineering or credential reuse. The risk remains moderate, but the potential for configuration abuse warrants immediate attention.