The CalJ Shabbat Times WordPress plugin versions up to 1.5 contain a missing authorization vulnerability (CWE-862) due to the absence of capability checks and nonce verification in the CalJSettingsPage class constructor. The constructor processes the 'save-obtained-key' POST operation without verifying that the user has the 'manage_options' capability. Since the plugin instantiates this class whenever is_admin() returns true, any authenticated user, including those with Subscriber-level access, can trigger this code path via wp-admin endpoints (e.g., admin-ajax.php). This allows unauthorized modification of the plugin's API key and clearing of the Shabbat cache, effectively compromising the plugin's API integration.

An authenticated attacker with Subscriber-level or higher access can modify the plugin's API key and clear its cache without proper authorization. This could lead to unauthorized control over the plugin's API integration, potentially disrupting its intended functionality or enabling further attacks that rely on the API key. There is no indication of direct confidentiality or availability impact beyond the integrity of the plugin's settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted users only and monitor for suspicious activity involving the CalJ plugin settings. Avoid granting unnecessary authenticated access to wp-admin endpoints. Implement additional access controls or custom capability checks if possible.