The LWSCache plugin for WordPress suffers from an improper authorization vulnerability (CWE-285) in the lwscache_activatePlugin() function affecting all versions up to 2.8.5. Authenticated users with low privilege (Subscriber-level) can activate arbitrary whitelisted LWS plugins, bypassing intended access controls. This could lead to unauthorized modification of plugin activation status within the WordPress environment. The CVSS 3.1 base score is 4.3 (medium), reflecting low complexity and limited impact on integrity only. No patch or vendor advisory is currently available to confirm remediation status.

The vulnerability allows unauthorized modification of plugin activation state by authenticated users with Subscriber-level access or above. This could potentially enable attackers to activate plugins they should not control, which may lead to further unauthorized actions depending on the activated plugins' capabilities. There is no impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor plugin activation activities closely. Avoid granting unnecessary plugin activation permissions to low-privilege users.