The Ziggeo WordPress plugin suffers from a missing authorization check in its AJAX handler. The handler only verifies a nonce and does not verify that the caller has the required capability. Because the nonce is exposed to all logged‑in users via the page head, any authenticated user with a Subscriber role or higher can invoke the wp_ajax_ziggeo_ajax action and carry out administrative changes such as modifying translation strings, creating or deleting event templates, altering SDK settings and changing notification options. This is a classic case of CWE‑862. The impact is that attackers can alter the plugin’s configuration and content, potentially disrupting service or user experience.

WordPress sites that have the Ziggeo plugin installed from oliverfriedmann, specifically all releases up to version 3.1.1, are affected. Any site running this plugin is therefore exposed.

The CVSS score is 5.4, indicating medium severity. The attack requires authentication but does not need administrator privileges; a subscriber is sufficient. The nonce is publicly exposed, so an attacker can construct an AJAX POST to /wp-admin/admin-ajax.php with action=ziggeo_ajax and the required parameters. Because no capability check is performed, the request succeeds and updates the database. EPSS data is not available and the issue is not listed in the CISA KEV catalog, but the potential for configuration damage warrants immediate remediation.