The WPSyncSheets Lite For WPForms – Google Sheets Connector plugin for WordPress suffers from a missing authorization check in the wpsslwp_reset_settings() function. This flaw allows any authenticated user with at least Subscriber privileges to reset the plugin's settings, potentially disrupting plugin operation or configuration. The vulnerability is tracked as CVE-2024-12164 and is categorized under CWE-862 (Missing Authorization). It affects all versions up to 1.6 and has a CVSS 3.1 base score of 4.3 (medium severity), reflecting low complexity and no impact on confidentiality or availability but limited impact on integrity.

An attacker with Subscriber-level access or higher can reset the plugin's settings without proper authorization. This could lead to unauthorized changes in plugin configuration, potentially disrupting data export functionality or causing denial of service for legitimate users relying on the plugin. There is no direct impact on confidentiality or availability reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for unusual activity related to plugin settings. Avoid granting Subscriber or higher privileges to untrusted users. Follow the vendor's updates closely for an official patch or temporary mitigation.