The Spice Starter Sites plugin for WordPress suffers from a missing capability check in the spice_starter_sites_importer_creater function in all versions up to 1.2.5. This missing authorization allows unauthenticated attackers to import demo content, effectively modifying site data without proper permissions. The vulnerability is tracked as CVE-2024-8430 with a CVSS 3.1 base score of 5.3 (medium severity), reflecting network attack vector, no privileges required, no user interaction, and impact limited to integrity loss.

An unauthenticated attacker can import demo content into a WordPress site using the vulnerable Spice Starter Sites plugin, leading to unauthorized modification of site data. There is no impact on confidentiality or availability. This could result in unwanted or malicious content being added to the site, potentially affecting site integrity and user trust.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to plugin functionality where possible and monitor for unusual import activity. Avoid using the plugin on publicly accessible sites without additional access controls.