The Social Images Widget plugin for WordPress suffers from a missing capability check (CWE-862) in its 'options_update' function across all versions up to 2.1. This authorization bypass vulnerability allows unauthenticated attackers to delete plugin settings by leveraging a forged request that requires a site administrator to be tricked into clicking a malicious link. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction indicated in the vector, and impact limited to integrity loss without confidentiality or availability impact. No patch or remediation is currently documented.

An attacker can cause unauthorized modification of the plugin's settings, specifically deletion, by exploiting the missing authorization check. This could disrupt the plugin's intended functionality but does not impact confidentiality or availability. The attack requires social engineering to trick an administrator into clicking a malicious link. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking unsolicited links and consider limiting administrative access or employing additional security controls such as web application firewalls to detect and block suspicious requests targeting the plugin's settings update functionality.