The Permalinks Cascade WordPress plugin up to version 2.2 suffers from a Missing Authorization vulnerability. This flaw allows authenticated users with subscriber-level access or higher to perform unauthorized administrative actions such as changing automatic pinging and page exclusion settings. The vulnerability arises from improper authorization checks in the handleTPCAdminAjaxRequest function.