Unauthorized Modification of Data in Child Theme Creator plugin for WordPress

CVE-2024-12263

Summary

The Child Theme Creator by Orbisius plugin for WordPress is susceptible to unauthorized data modification due to a lack of capability checks on the cloud_delete() and cloud_update() functions. This vulnerability enables authenticated attackers, even those with Subscriber-level access, to manipulate cloud snippets, allowing them to perform updates and deletions. This security flaw resides within the Cloud Library Addon connected to the plugin, which has since been withdrawn. Users of affected versions are advised to take immediate precautions to secure their sites.

References