Improper Privilege Management in Travel Management - #VU19927

The vulnerability allows a remote attacker to escalate privilege on the target system.

The vulnerability exists due to the missing capability check in the ‘update_option’ function. A remote attacker can send a specially crafted AJAX request to the "nd_options_import_settings_php_function" and change the blog settings, for instance the site URL, the admin email address, user roles and capabilities, or give administrator privilege to any new registered user.