The Comparison Slider plugin for WordPress suffers from a missing capability check on multiple AJAX endpoints, enabling authenticated users with low privileges (subscriber or above) to perform unauthorized modifications to plugin data, such as changing settings or deleting sliders. This vulnerability is tracked as CWE-862 (Missing Authorization). It affects all versions up to and including 1.0.5. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges, resulting in integrity impact but no confidentiality or availability impact.

An attacker with subscriber-level access or higher can exploit this vulnerability to alter plugin settings and delete sliders without authorization. This could disrupt the intended functionality of the plugin and potentially affect website content presentation. There is no impact on confidentiality or availability reported.

No official patch or fix has been published yet for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access where possible and monitor for suspicious changes to plugin settings. Avoid granting unnecessary privileges to low-level authenticated users.