The Ziggeo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1. The wpajaxziggeoajax handler only verifies a nonce (checkajaxreferer) but performs no capability checks via currentusercan(). Furthermore, the nonce ('ziggeoajaxnonce') is exposed to all logged-in users on every page via the wphead and adminhead hooks . This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke multiple administrative operations including: saving arbitrary translation strings (translationspanelsavestrings via updateoption('ziggeotranslations')), creating/updating/deleting event templates (eventeditorsavetemplate/updatetemplate/removetemplate via updateoption('ziggeoevents')), modifying SDK application settings (sdkapplications operations), and managing notifications (notificationhandler via updateoption('ziggeonotifications')).