Access violation vulnerability in Zephyr Project Manager 3.3.101

The Zephyr Project Manager plugin for WordPress has a security issue that allows certain users to gain more privileges than they should have. This affects all versions up to 3.3.101. The problem is that the plugin doesn’t check a user’s permissions before letting them change the plugin’s settings using the update_user_access() function. This means that someone with subscriber-level access or higher can give themselves complete control over the plugin’s settings.