The Web and WooCommerce Addons for WPBakery Builder plugin for WordPress suffers from a missing capability check (CWE-862) in multiple plugin functions. This flaw enables authenticated users with low-level privileges (Subscriber or above) to alter plugin settings unauthorizedly. The vulnerability affects all versions up to 1.4.5 and has a CVSS 3.1 base score of 4.3, reflecting a medium severity impact primarily on integrity. No known exploits are reported in the wild, and no patch or remediation details are provided by the vendor.

An attacker with authenticated Subscriber-level access or higher can modify plugin settings without proper authorization, potentially leading to unauthorized changes in site behavior or configuration. The vulnerability does not impact confidentiality or availability, only integrity of plugin settings. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for unauthorized changes to plugin settings. Avoid granting Subscriber-level or higher access to untrusted users.