ShopLentor < 2.8.9 - Authenticated Option Update

Description

The plugin is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function. This makes it possible for authenticated attackers, with contributor-level access and above, to set arbitrary WordPress options to "true". NOTE: This vulnerability can be exploited by attackers with subscriber- or customer-level access and above if (1) the WooCommerce plugin is deactivated or (2) access to the default WordPress admin dashboard is explicitly enabled for authenticated users.