Unauthorized Data Modification Vulnerability in Industrial Theme for WordPress

CVE-2024-13376

Summary

The Industrial theme for WordPress is susceptible to a vulnerability that allows for unauthorized data modification due to a lack of a necessary capability check in the _ajax_get_total_content_import_items() function. This affects all versions up to and including 1.7.8. Authenticated users with subscriber-level access or higher can exploit this flaw to alter arbitrary site options, which may include setting the default registration role to administrator and enabling user registration. This could potentially allow attackers to gain administrative access to a vulnerable WordPress site.

References