Unauthorized Data Modification in CozyStay for WordPress by CozyStay Inc.
CVE-2024-13412
7.5HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 19 March 2025
What is CVE-2024-13412?
The CozyStay theme for WordPress is affected by a vulnerability that allows unauthorized modification of data. This stems from a missing capability check in the ajax_handler function, which is present in all versions up to and including 1.7.0. As a result, unauthenticated attackers can potentially execute arbitrary actions, posing significant risks to the integrity of the site and its data. Website owners using the CozyStay theme should take immediate action to secure their installations.
Affected Version(s)
CozyStay - Hotel Booking WordPress Theme * <= 1.7.0