Theme Vulnerable to Unauthorized Plugin Installation

CVE-2024-10674

What is CVE-2024-10674?

The Th Shop Mania theme for WordPress contains a vulnerability that permits unauthorized arbitrary plugin installation due to a lack of necessary capability checks in the th_shop_mania_install_and_activate_callback() function. This issue affects all versions up to and including 1.4.9. Authenticated attackers with a minimum of Subscriber-level access can exploit this vulnerability to install arbitrary plugins, which could further be used to target other vulnerabilities, resulting in potential remote code execution and privilege escalation.

References