The ConvertPlus WordPress plugin suffers from a missing capability check on the 'cp_dismiss_notice' AJAX endpoint in all versions up to 3.5.30. This allows authenticated users with low privileges (Subscriber and above) to update option values to '1', potentially causing site errors that result in denial of service or enabling unwanted site behaviors like forced registration. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS 3.1 score is 8.1, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts.

An attacker with Subscriber-level access can exploit this vulnerability to modify site options without proper authorization, leading to denial of service conditions by triggering site errors or enabling undesired features such as forced user registration. This compromises the integrity and availability of the affected WordPress site but does not affect confidentiality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access where possible and monitor for unusual changes to site options related to the ConvertPlus plugin. Avoid granting unnecessary privileges to low-level authenticated users.