The Zephyr Project Manager plugin for WordPress suffers from improper authorization (CWE-285) in all versions up to 3.3.101. The vulnerability arises because the plugin does not correctly verify user capabilities before allowing access to modify plugin settings via the update_user_access() function. Authenticated users with subscriber-level privileges or higher can exploit this to escalate their privileges to full administrative control over the plugin settings. This vulnerability is network exploitable without user interaction and impacts confidentiality and integrity with high severity.

An attacker with authenticated subscriber-level access can escalate privileges to gain full control over the Zephyr Project Manager plugin settings. This can lead to unauthorized changes in project management configurations, potentially affecting the confidentiality and integrity of project data managed through the plugin. There is no indication of impact on availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level user access where possible and monitor for unusual privilege escalations related to the plugin. Avoid granting unnecessary user roles that could exploit this vulnerability.