The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin suffers from a missing capability check (CWE-862) in its save_global_settings and process_form_edit functions in all versions up to 1.2.2. This allows authenticated users with low-level privileges (Subscriber and above) to update plugin settings and forms unauthorized. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or official fix is currently documented, and the plugin is not a cloud service, so remediation depends on vendor updates.

An attacker with Subscriber-level access or higher can modify the plugin's settings and forms without proper authorization, potentially leading to unauthorized changes in site behavior related to frontend post submissions. This impacts the integrity of the plugin's configuration but does not compromise confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor for unusual changes in plugin settings. Avoid granting unnecessary privileges to low-level users. Follow vendor communications for updates on patches or temporary fixes.