CVE-2026-4124 describes a missing authorization vulnerability (CWE-862) in the Ziggeo WordPress plugin (versions up to 3.1.1). The wp_ajax_ziggeo_ajax handler relies solely on nonce verification without performing capability checks via current_user_can(). The nonce 'ziggeo_ajax_nonce' is exposed to all logged-in users on every page, enabling authenticated users with minimal privileges (Subscriber-level) to invoke administrative operations such as saving translation strings, managing event templates, modifying SDK application settings, and handling notifications through update_option calls. This flaw allows privilege escalation within the plugin's administrative functions.

Authenticated users with Subscriber-level access or higher can exploit this vulnerability to perform unauthorized administrative actions within the Ziggeo plugin. This includes modifying plugin settings and data that should be restricted to higher privilege roles. The impact is limited to integrity and availability aspects of the plugin's functionality, with no direct confidentiality impact reported. The CVSS score of 5.4 reflects a medium severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting plugin usage to trusted users only or disabling the plugin if possible. Monitoring for plugin updates from the vendor is recommended to apply any forthcoming patches promptly.