The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveinstantindexingsettings() function in versions up to, and including, 2.6.23. This function is registered on the admininit hook and only checks for the presence of $POST['submit'] before writing attacker-supplied $POST['metasyncposttypes'] into the site-wide 'metasyncoptionsinstantindexing' option via updateoption(); no currentusercan()/currentuserhaspluginaccess() check and no nonce verification are performed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the site's Google Instant Indexing post-type configuration, controlling which post types are auto-submitted to Google's Instant Indexing service.