Unauthorized Plugin Installation Vulnerability Affects Top Store WordPress Theme

CVE-2024-10673

8.8HIGH

Key Information

Vendor: Themehunk
Status: Top Store
Vendor: CVE Published:; 9 November 2024

Summary

The Top Store theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the top_store_install_and_activate_callback() function in all versions up to, and including, 1.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins which can contain other exploitable vulnerabilities to elevate privileges and gain remote code execution.

Affected Version(s)

Top Store <= 1.5.4

CVSS V3.1

Score:

8.8

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published.
Nov 9, 2024
Disclosed
Nov 8, 2024
Vulnerability Reserved.
Nov 1, 2024

Collectors

NVD DatabaseMitre Database

Credit

Sean Murphy

Kevin Murphy