The CallbackKiller service widget, a WordPress plugin, suffers from a missing capability check in the cbk_save() function across all versions up to 1.2. This flaw allows any visitor to invoke the Ajax endpoint cbk_save_v1 and alter the plugin’s site ID settings without authentication, effectively modifying configuration data. The vulnerability enables unauthorized data modification but does not provide immediate code execution.

The vulnerable product is the CallbackKiller service widget developed by krellbat for WordPress. All releases with a version number of 1.2 or lower are affected. WordPress sites that have installed or are still using any of these versions are at risk.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% reflects a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An unauthenticated attacker can directly send an Ajax request to the cbk_save_v1 endpoint, bypassing any capability checks, because the plugin lacks proper authorization logic. The attack vector is publicly accessible through the target site’s URL.