Unauthorized Data Modification Vulnerability in ZoxPress Theme by WordPress

CVE-2024-13653

Summary

The ZoxPress WordPress theme is susceptible to unauthorized data modification due to a lack of capability validation in its 'backup_options' function. This flaw allows authenticated users with at least Subscriber access to change site options arbitrarily. Attackers can exploit this vulnerability to alter the default registration role to administrator and enable user registration, providing a pathway for them to gain elevated access on the compromised site.

References