The Starbox – the Author Box for Humans WordPress plugin versions up to 3.4.7 contain an insecure direct object reference vulnerability caused by missing validation on a user-controlled key in the action function. This improper access control (CWE-284) permits subscribers, who normally have limited privileges, to view plugin preferences and potentially other user settings. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity, with network attack vector, low attack complexity, and no user interaction required. The impact is limited to confidentiality loss without affecting integrity or availability. No patch or official remediation has been documented yet.

Subscribers can access plugin preferences and potentially other user settings that should be restricted, leading to limited confidentiality loss. There is no impact on data integrity or system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber privileges where possible and monitor for updates from the plugin vendor. No official fix or temporary workaround has been documented at this time.