The Social Auto Poster plugin for WordPress suffers from a missing capability check in the 'wpw_auto_poster_update_tweet_template' function in all versions up to 5.3.14. This authorization bypass enables authenticated users with low privileges (Subscriber and above) to update arbitrary post metadata, which should normally require higher privileges. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact.

An attacker with at least Subscriber-level access can modify arbitrary post metadata, potentially leading to unauthorized changes in site content or disruption of site functionality (availability impact). There is no direct confidentiality impact reported. The integrity of post metadata can be compromised, which may affect site behavior or content presentation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, administrators should monitor WPWeb's official channels for updates. Until a fix is available, consider restricting Subscriber-level access or disabling the Social Auto Poster plugin if feasible to reduce risk.