Access violation vulnerability in Qubely – Advanced Gutenberg Blocks 1.7.8

Qubely is a plugin for WordPress websites. A security vulnerability was found in versions up to 1.7.8, which allowed users with the lowest access level (subscribers) to change the plugin’s settings. This was due to a missing authorization check for the ajax_update_qubely_options() function that is called by the wp_ajax_update_qubely_options AJAX action. This allowed any authenticated user to access it.