The Editorial Assistant by Sovrn WordPress plugin suffers from a missing capability check in the ajax_zemanta_set_featured_image function. This flaw permits authenticated users with subscriber-level privileges or above to upload attachment files (e.g., jpg, png, txt, zip) and set the featured image of posts. The vulnerability is classified under CWE-862 (Missing Authorization) and affects versions up to 1.3.3. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring low privileges but no user interaction, and resulting in limited integrity impact without confidentiality or availability loss.

An attacker with subscriber-level access can upload arbitrary attachment files and modify the featured image of posts, potentially altering site content without proper authorization. There is no direct confidentiality or availability impact reported. The integrity of post content can be affected, which may lead to misinformation or unauthorized content display.

No official patch or fix is currently confirmed or available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict subscriber-level user capabilities if possible, and monitor for unauthorized content changes. Avoid granting unnecessary privileges to low-level users.