Wordpress Alert: Unauthorized settings changes

What it looks like

A low-privilege request updates site options or plugin configuration.

Why it matters

Security controls, destinations, or site behavior may be changed.

What to check

Verify that settings handlers require the proper capability and protect browser-origin actions.

Documentation

This is an exploit pattern to check in installed components, not a claim that every WordPress site has this flaw. Confirm the product and version against its advisories before treating a site as affected. See WordPress roles and capabilities, WordPress nonces.