Tilda Publishing <= 0.3.23 - Missing Authorization

The Tilda Publishing plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on several functions hooked via AJAX actions such as 'ajax_export_file,' 'ajax_sync,' 'ajax_get_keys,' 'ajax_switcher_status,' and more in versions up to, and including, 0.3.23. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform a wide variety of actions like exporting data, modifying keys, and more.