The desertsnowman Plugin Groups plugin for WordPress suffers from a missing capability check in its admin_init() function across all versions up to 2.0.6. This lack of authorization verification enables unauthenticated attackers to alter plugin settings, potentially causing denial of service conditions due to misconfiguration. The vulnerability is tracked as CVE-2024-1108 and classified under CWE-862 (Missing Authorization). It has a CVSS 3.1 score of 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and low availability impact.

An unauthenticated attacker can modify the Plugin Groups plugin settings without authorization. This unauthorized modification can disrupt normal plugin operation, potentially causing denial of service through misconfiguration. There is no direct confidentiality impact reported. The integrity of plugin settings is compromised, and availability may be affected due to misconfiguration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the WordPress admin area and monitor for unauthorized changes to plugin settings. Consider disabling or removing the Plugin Groups plugin if it is not essential to reduce exposure.