The vulnerability identified as CVE-2024-8199 in the smub WordPress plugin arises from a missing capability check (CWE-862) in the 'update_api_key' function. This flaw permits authenticated users with low privileges (Subscriber-level and above) to update API key options without proper authorization. The plugin version affected includes all versions up to 1.1.2. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or vendor advisory is provided, and no exploits are known in the wild.

An attacker with Subscriber-level access or higher can modify API key options within the plugin, potentially leading to unauthorized changes in how the plugin interacts with external review services. This impacts the integrity of the plugin's configuration but does not affect confidentiality or availability. The vulnerability could allow limited unauthorized modification of data related to API keys.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for unauthorized changes to plugin settings. Avoid granting Subscriber-level or higher access to untrusted users. Review and audit API key usage regularly.