The IgnitionDeck Crowdfunding Platform plugin for WordPress suffers from a Missing Authorization vulnerability (CWE-862) in versions up to and including 1.9.8. The issue arises because various AJAX actions invoked via the ~/classes/class-idf-wizard.php file lack proper capability checks. As a result, authenticated users with minimal privileges (subscriber or higher) can execute these AJAX actions, potentially modifying permalink structures, plugin settings, and other configurations without proper authorization. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required at the level of a subscriber.

An attacker with subscriber-level access to a WordPress site using the vulnerable IgnitionDeck plugin can exploit this flaw to perform unauthorized changes to site configurations, including permalink structures and plugin settings. This could lead to site misconfiguration and potential denial of service or degraded functionality. There is no indication of direct confidentiality impact, but integrity and availability impacts are present at a low to medium level. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, administrators should monitor the IgnitionWP vendor advisories for updates. In the meantime, restrict subscriber-level access where possible and consider disabling or removing the IgnitionDeck Crowdfunding Platform plugin if not essential. Avoid granting unnecessary privileges to low-level users to reduce risk.