Technical impact
The CalJ Shabbat Times WordPress plugin is vulnerable to missing authorization (CWE-862) in all versions up to 1.5, as the CalJSettingsPage constructor processes the 'save-obtained-key' POST action without verifying that the user has 'manage_options' or even checking a nonce, allowing any authenticated user with Subscriber-level access or higher to modify the plugin’s API key and clear its cache, effectively taking control of the external API integration. This does not provide arbitrary code execution but permits an attacker to alter the plugin’s configuration and disrupt its intended operation.
Affected Systems
WordPress installations that have the CalJ Shabbat Times plugin version 1.5 or earlier are affected, as the vulnerability resides in the CalJSettingsPage constructor and is triggered whenever the admin context is detected (for any authenticated admin or subscriber accessing wp-admin or admin-ajax). The plugin allows an attacker to modify the settings via the 'save-obtained-key' action because no capability check nor nonce verification is performed. Sites using CalJ 1.5 or older, with at least a Subscriber role, are therefore at risk.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate severity, and the requirement for authentication means that the attack can only be carried out by users who are logged in to WordPress. No known public exploit or KEV listing exists, and the EPSS score is currently unavailable, leaving the current exploitation probability uncertain. Based on the description, the likely attack vector is a crafted POST request to the admin interface that includes the 'save-obtained-key' action; an authenticated attacker could exploit the missing authorization and lack of nonce to modify the plugin's API key and cache without needing elevated privileges beyond Subscriber.
