Access violation vulnerability in Qubely – Advanced Gutenberg Blocks 1.8.0

The Qubely plugin for WordPress contains an issue that allows users with contributor-level permissions to update the plugin’s settings in versions up to and including 1.7.8. This is because the current_user_can() function checks for the edit_posts permission instead of the manage_options permission, which is only available to administrators. This issue is triggered by the ajax_update_qubely_options() function, which is called via the wp_ajax_update_qubely_options AJAX action.