Unauthorized Data Modification in CozyStay for WordPress by CozyStay Inc.
CVE-2024-13412

7.5HIGH

Key Information:

Vendor

WordPress
Status
Cozystay - Hotel Booking WordPress Theme
Vendor
CVE Published:
19 March 2025

What is CVE-2024-13412?

The CozyStay theme for WordPress is affected by a vulnerability that allows unauthorized modification of data. This stems from a missing capability check in the ajax_handler function, which is present in all versions up to and including 1.7.0. As a result, unauthenticated attackers can potentially execute arbitrary actions, posing significant risks to the integrity of the site and its data. Website owners using the CozyStay theme should take immediate action to secure their installations.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

CozyStay - Hotel Booking WordPress Theme * <= 1.7.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://themeforest.net/item/cozystay-hotel-booking-wordp...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lucio Sá
JSON
.