The Library Management System plugin for WordPress, developed by owthub, suffers from a missing capability check in the owt7_library_management_ajax_handler() function in all versions up to 3.1. This authorization bypass allows any authenticated user with at least Subscriber privileges to update and manipulate various plugin settings and features. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring low privileges, no user interaction, and resulting in limited impact on integrity but no impact on confidentiality or availability.

An attacker with authenticated Subscriber-level access or higher can exploit this vulnerability to modify plugin settings and features without proper authorization. This unauthorized modification could affect the integrity of the plugin's configuration but does not impact confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to plugin settings modifications. Avoid granting unnecessary privileges to users and consider disabling or replacing the plugin if unauthorized changes are a concern.