The 24liveblog plugin for WordPress has a missing authorization check in its update_lb24_token() AJAX handler. The function verifies only a nonce that is generated for any block editor user, but it does not confirm that the caller has sufficient capabilities or that the supplied user_id matches the current user. Because of this, any authenticated user with author role or higher can overwrite the lb24_token, lb24_uid, lb24_refresh_token, and lb24_uname meta fields of any user, including administrators, as well as the related sitewide options. The attacker can thus hijack the integration with the external 24liveblog service, potentially gaining further access to or manipulation of the service’s content.

Installations of the 24liveblog WordPress plugin version 2.2 or earlier are affected. The vulnerability originates in PHP code files exposed in the plugin’s source, as highlighted in the provided URLs.

The CVSS base score is 4.3, assigning this flaw a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating a lower current exploitation probability. Nonetheless, the attack requires only author‑level or higher credentials and is straightforward: an attacker can invoke the AJAX endpoint and overwrite any user’s plugin metadata. The root cause is a missing capability check, which permits privilege escalation and data tampering.