The Aruba HiSpeed Cache plugin for WordPress suffers from missing capability checks in multiple functions, allowing unauthenticated attackers to modify plugin settings. This lack of authorization verification enables attackers to change configuration parameters, toggle features, and control WordPress cron jobs or debug mode. The vulnerability affects all versions up to and including 3.0.2. It is identified as CWE-862 (Missing Authorization) and has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation allows an unauthenticated attacker to alter the plugin's configuration settings, potentially leading to unauthorized changes in caching behavior, enabling or disabling features, and manipulating WordPress cron jobs or debug mode. This compromises the integrity and confidentiality of the affected system's configuration but does not directly impact availability. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users should monitor the vendor's advisory channels for updates and apply any official patches once released. Until a patch is available, restrict access to the plugin files and consider disabling the plugin if feasible to prevent exploitation.