Theme Vulnerable to Unauthorized Plugin Installation

CVE-2024-10674

What is CVE-2024-10674?

The Th Shop Mania theme for WordPress contains a vulnerability that permits unauthorized arbitrary plugin installation due to a lack of necessary capability checks in the th_shop_mania_install_and_activate_callback() function. This issue affects all versions up to and including 1.4.9. Authenticated attackers with a minimum of Subscriber-level access can exploit this vulnerability to install arbitrary plugins, which could further be used to target other vulnerabilities, resulting in potential remote code execution and privilege escalation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References