Product
An unauthenticated or low-privilege authenticated user can leverage a missing capability check in the wpematico_import_settings function to modify site options, enabling unauthorized privilege escalation.