The NitroPack plugin for WordPress suffers from a missing authorization check in the nitropack_rml_notification function, allowing authenticated users with subscriber-level access or higher to update arbitrary transient values. This vulnerability is classified as CWE-862 (Missing Authorization). The transients can only be updated to integer values, limiting the scope of potential impact. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. The vulnerability affects all versions up to 1.17.0. There is no vendor advisory or patch link available at this time.

An authenticated attacker with subscriber or higher privileges can update arbitrary transient values to integers, potentially impacting the integrity of cached or transient data within the NitroPack plugin. There is no impact on confidentiality or availability. The vulnerability does not allow arbitrary code execution or data disclosure. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for suspicious activity related to transient updates. Avoid granting subscriber or higher privileges to untrusted users.