The Linkz.ai plugin for WordPress suffers from a missing authorization check (CWE-862) in its 'ajax_linkz' function in versions up to and including 1.1.8. This flaw enables authenticated users with contributor or higher privileges to update plugin settings without proper permission validation. The vulnerability has a CVSS v3.1 base score of 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and low availability impact. No patch or official fix information is available from the vendor at this time.

An attacker with contributor-level or higher access can modify plugin settings unauthorizedly, potentially affecting the integrity and availability of the plugin's functionality. There is no impact on confidentiality. The vulnerability could be leveraged to alter plugin behavior or disrupt service, but exploitation requires authenticated access at a contributor level or above.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for suspicious activity related to plugin settings changes. Avoid granting unnecessary privileges to users to reduce risk.