The elfsight Pricing Table plugin for WordPress suffers from a missing capability check in its ajax() function across all versions up to and including 2.0.1. This CWE-862 vulnerability allows authenticated users with subscriber-level privileges or higher to bypass authorization controls and perform unauthorized modifications to pricing tables. The CVSS 3.1 base score is 5.4, reflecting a network attack vector with low attack complexity, requiring privileges but no user interaction, and resulting in limited confidentiality and integrity impacts without availability impact.

An attacker with subscriber-level access or higher can exploit this vulnerability to edit pricing tables without proper authorization. This could lead to unauthorized data modification within the plugin's scope, potentially affecting the integrity and confidentiality of pricing information managed by the plugin. There is no indication of impact on system availability or broader WordPress functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user capabilities where possible and monitor for plugin updates from elfsight addressing this issue.