The WP Force SSL & HTTPS SSL Redirect plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the 'ajax_save_setting' function in versions up to and including 1.66. This flaw allows authenticated users with low-level privileges (subscriber and above) to update plugin settings without proper permission checks. The vulnerability has a CVSS 3.1 base score of 4.2, indicating medium severity, with network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact. No patch or official fix has been documented in the provided data.

An attacker with subscriber-level access or higher can modify the plugin's settings without authorization. This unauthorized modification could potentially alter site security configurations related to SSL enforcement, possibly weakening the site's security posture or causing denial of service conditions. There is no indication of confidentiality impact, but integrity and availability impacts are rated low. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles carefully to prevent untrusted users from having subscriber-level or higher access. Monitor plugin updates from the vendor for a security patch addressing this missing authorization vulnerability.