Fancy Product Designer < 4.7.0 - Subscriber+ Unauthorized Site Options Modification

Description

The plugin does not properly implement capability checks on the fpd_update_options function. This can result in unauthorized modification of site options by authenticated users with subscriber-level permissions, including the ability to escalate privileges by setting the default role to administrator.