The Yumpu E-Paper publishing plugin for WordPress suffers from a missing capability check (CWE-862) in its ajax_handler function in all versions up to and including 2.0.24. This flaw permits authenticated users with subscriber-level privileges or higher to perform unauthorized actions such as uploading and publishing PDF files and modifying the API key. The vulnerability has a CVSS 3.1 base score of 5.0, reflecting medium severity with network attack vector, low attack complexity, and no user interaction required. The impact is limited to integrity, with no confidentiality or availability impact reported.

An attacker with subscriber-level access or higher can exploit this vulnerability to modify published content and change the API key, potentially affecting the integrity of the published ePapers. There is no direct impact on confidentiality or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and monitor for unusual activity related to PDF uploads and API key changes. Avoid granting unnecessary privileges to low-level authenticated users.