The CalJ Shabbat Times WordPress plugin versions up to 1.5 suffer from a missing authorization vulnerability (CWE-862) due to the absence of capability checks and nonce verification in the CalJSettingsPage class constructor. This constructor processes the 'save-obtained-key' operation directly from POST data whenever is_admin() returns true, which includes any authenticated user accessing wp-admin URLs. Consequently, users with Subscriber-level privileges or higher can alter the plugin's API key and clear the Shabbat cache, effectively gaining control over the plugin's API integration. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity. There is no vendor advisory or patch currently available.

An authenticated attacker with at least Subscriber-level access can modify the CalJ plugin's API key setting and clear its Shabbat cache without proper authorization. This could lead to unauthorized control over the plugin's API integration, potentially disrupting functionality or causing misuse of API resources. There is no indication of direct confidentiality or availability impact beyond the integrity of the plugin's API key setting.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to wp-admin URLs to trusted users only and consider disabling or removing the CalJ plugin if possible to prevent exploitation. Monitor for updates from the vendor regarding patches or official mitigations.