The CallbackKiller service widget plugin for WordPress suffers from a missing authorization check (CWE-862) in its cbk_save() function. This flaw enables unauthenticated attackers to invoke the 'cbk_save_v1' AJAX action and modify the plugin's site ID settings without proper capability verification. The issue affects all versions up to 1.2 and is classified with a CVSS 3.1 score of 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact. No known exploits are reported in the wild, and no patch or remediation guidance is currently provided by the vendor.

An attacker can modify the plugin's site ID settings without authentication, potentially leading to unauthorized changes in plugin configuration. There is no direct impact on confidentiality or availability, but integrity of the plugin's settings is compromised. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to AJAX endpoints or disabling the plugin if feasible to reduce exposure. Monitor official vendor channels for updates regarding a patch or official fix.