The Canto WordPress plugin contains a missing authorization flaw in its AJAX endpoints updateOptions and fbc_updateOptions. The functions have no capability check or nonce validation, allowing any logged‑in user with subscriber rights or higher to call them. This vulnerability lets the attacker alter or delete all plugin configuration parameters that control cron scheduling and the scheduled WordPress cron event. The flaw is mapped to CWE‑862 and can effectively disable or modify the plugin’s scheduled tasks.

This issue affects the Canto content management plugin for WordPress versions up to 3.1.1. Any WordPress site running that version, regardless of other plugins or theme, is vulnerable.

The CVSS v3.1 score is 4.3, indicating moderate impact. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalogue, suggesting limited public exploitation data. Because the flaw is only exposed to authenticated users and no privileges are checked, any user with subscriber-level access can exploit it. The lack of a nonce check also means the attack can be performed via crafted HTTP requests, making it relatively straightforward for an insider or compromised account. While the current risk is moderate, the ability to change scheduled cron events could lead to denial of service or execution‑timing changes if a malicious actor gains access.