CVE-2024-13654
Published: 12 February 2025
Description
The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'reset_options' function in all versions up to, and including, 2.12.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.
Security Summary
CVE-2024-13654 is a vulnerability in the ZoxPress - The All-In-One WordPress News Theme for WordPress, affecting all versions up to and including 2.12.0. It stems from a missing capability check on the 'reset_options' function (CWE-862), enabling unauthorized modification of data that can result in denial of service. The issue has a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), highlighting its high severity due to network accessibility, low complexity, and impacts on integrity and availability.
Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability remotely without user interaction. They gain the ability to delete arbitrary option values stored on the WordPress site, which can be leveraged to trigger site errors and deny service to legitimate users by disrupting critical functionality.
Advisories, including the Wordfence threat intelligence report (https://www.wordfence.com/threat-intel/vulnerabilities/id/f616be03-229b-4c50-b837-508da4d2b090?source=cve) and the theme's ThemeForest page (https://themeforest.net/item/zoxpress-allinone-wordpress-news-theme/25586170), provide further details on the issue, though specific patch information is not detailed in the CVE description. Security practitioners should monitor for updates from the theme vendor.
Details
- CWE(s)