The ConvertPlus plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the cp_dismiss_notice() function, which lacks proper capability checks. This flaw permits authenticated users with minimal privileges (subscriber-level and above) to update arbitrary option values to true, potentially impacting the integrity and availability of plugin settings. The vulnerability is present in all versions up to 3.5.25. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with subscriber-level access or higher can exploit this vulnerability to modify arbitrary option values within the ConvertPlus plugin. This could lead to unauthorized changes in plugin behavior or settings, potentially affecting site functionality or availability. There is no direct confidentiality impact reported. No known active exploitation has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor for unusual changes in plugin options. Avoid granting unnecessary privileges to authenticated users. Follow Brainstorm Force's official channels for updates on patches or mitigations.