24liveblog <= 2.2 - Missing Authorization to Authenticated (Author+) Settings Modification via update_lb24_token AJAX action

An authenticated attacker with author-level access or higher can craft a POST request to the `wp_ajax_update_lb24_token` action. The handler only checks the `lb24` nonce (which is exposed to any user with block editor access via `lb24_settings_assets()`) and does not verify that the supplied `user_id` parameter belongs to the current user or that the user has the required capabilities. By providing an arbitrary `user_id` and attacker-controlled token values (`user_token`, `user_uid`, `user_refresh_token`, `user_uname`), the attacker overwrites both the targeted user's meta fields and the corresponding site-wide options, effectively hijacking the plugin's integration with the 24liveblog service.

The vulnerability resides in the `update_lb24_token()` AJAX handler defined in `plugin.php`. The function is registered via `wp_ajax_update_lb24_token` and lacks any capability or ownership check — it only verifies the `lb24` nonce via `check_ajax_referer`. The `lb24_settings_assets()` function localizes this nonce to any user with block editor access, making it available to authenticated attackers with author-level access and above.

The patch does not show a fix; the provided references are all the same vulnerable version of `plugin.php`. The advisory states that the fix should add a capability check (e.g., `current_user_can('manage_options')`) and verify that the supplied `user_id` matches the current user's ID before performing the update operations. Without these checks, any authenticated user with block editor access can overwrite arbitrary user meta and site options.