WordPress Total theme <= 2.1.19 - Authenticated Arbitrary Plugin Activation

CVE-2023-27456

Summary

A critical vulnerability affecting the HashThemes Total WordPress theme arises from missing authorization, which permits exploitation of incorrectly configured access control settings. This flaw allows unauthorized users to activate plugins without proper permissions, posing significant risks to WordPress sites relying on this theme. The vulnerability is present in Total versions ranging from an unspecified release up to 2.1.19, emphasizing the need for urgent security measures for affected installations.

References