CVE-2026-4124 describes a missing authorization vulnerability (CWE-862) in the Ziggeo WordPress plugin (versions up to 3.1.1). The wp_ajax_ziggeo_ajax handler relies solely on nonce verification (check_ajax_referer) without enforcing capability checks via current_user_can(). The nonce 'ziggeo_ajax_nonce' is exposed to all logged-in users through wp_head and admin_head hooks, enabling authenticated users with minimal privileges (Subscriber-level) to invoke administrative operations such as saving translation strings, managing event templates, modifying SDK application settings, and handling notifications by updating plugin options.

Authenticated users with Subscriber-level privileges or higher can exploit this vulnerability to perform unauthorized administrative actions within the Ziggeo plugin. This includes modifying plugin settings and data that should be restricted, potentially impacting the integrity and availability of plugin functionality. There is no indication of direct confidentiality impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin access to trusted users only and consider removing or disabling the Ziggeo plugin if possible. Monitor for updates from the vendor or WordPress plugin repository for a security patch addressing this issue.