TelSender <= 1.14.8 - Missing Authorization

Description The TelSender plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tscfwc_form_ajax_reqest() function hooked via an AJAX action in versions up to, and including, 1.14.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin’s settings.