CVE-2024-11936
Published: 26 January 2025
Description
The Zox News theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'backup_options' and 'restore_options' function in all versions up to, and including, 3.16.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Security Summary
CVE-2024-11936 is a vulnerability in the Zox News theme for WordPress, affecting all versions up to and including 3.16.0. It stems from a missing capability check on the 'backup_options' and 'restore_options' functions, enabling unauthorized modification of data that leads to privilege escalation. The issue is rated with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-862 (Missing Authorization).
Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction required. By calling the affected functions, they can update arbitrary WordPress site options, such as setting the default role for new user registrations to administrator and enabling registration. This allows attackers to self-register with administrative privileges, achieving full site compromise.
Advisories, including the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/3f061e7f-6a87-4d4a-9b4e-8234883f2ebc?source=cve, provide further details on the vulnerability. The theme's product page is available at https://themeforest.net/item/zox-news-professional-wordpress-news-magazine-theme/20381541.
Details
- CWE(s)