The Instant Images WordPress plugin suffers from a missing authorization vulnerability (CWE-862) in its REST API endpoint instant-images/license. This flaw allows authenticated users with author or higher privileges to update arbitrary plugin options without proper verification that the options belong to the plugin. The vulnerability affects all versions up to 6.1.0 and can lead to full compromise of plugin settings, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges at the author level, no user interaction, and high impact on all security properties. No patch or remediation details are currently provided by the vendor or advisory sources.

Successful exploitation allows an attacker with author-level or higher privileges to modify arbitrary plugin options, potentially leading to full compromise of plugin functionality and data integrity. The vulnerability impacts confidentiality, integrity, and availability of the affected WordPress plugin environment. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict author-level privileges to trusted users only and monitor plugin updates from the vendor. Avoid granting author or higher privileges to untrusted users to reduce risk.