The WPGSI: Spreadsheet Integration plugin for WordPress suffers from a missing capability check (CWE-862) in multiple functions, enabling authenticated users with low privileges (Subscriber-level and above) to perform unauthorized actions such as editing post statuses and creating or modifying Google Sheet integrations. This vulnerability affects all versions up to 3.8.0. The CVSS 3.1 base score is 6.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. No patch or vendor advisory has been provided to confirm remediation status.

An attacker with at least Subscriber-level access can exploit this vulnerability to modify post statuses and manipulate Google Sheet integrations within the WordPress environment. This could lead to unauthorized data modification and potential disruption of site content or integration workflows. The impact includes limited confidentiality, integrity, and availability loss as indicated by the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and review permissions carefully to limit Subscriber-level access. Monitor plugin updates from the vendor for a security patch addressing this issue.