The Infility Global WordPress plugin suffers from a missing capability check in the infility_global_ajax function in all versions up to 2.9.8. This lack of proper authorization verification permits authenticated users with low privileges (Subscriber-level and above) to update plugin options, which could lead to site instability or breakage. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 6.5 (medium), reflecting network attack vector, low attack complexity, required privileges at the low level, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

Authenticated users with Subscriber-level privileges or higher can modify plugin options without proper authorization checks, potentially causing site disruption or breakage. There is no confidentiality or availability impact reported, but the integrity of the plugin configuration can be compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access if possible and monitor plugin configurations for unauthorized changes. Avoid granting unnecessary privileges to users. Follow updates from the Infility plugin vendor for any forthcoming patches or official mitigations.