CVE-2023-6876 MEDIUM

CVE-2023-6876: Clever Fox – One Click Website Importer by Nayra Themes <= 25.2.0 - Missing Authorization to arbitrary theme activation via clever-fox-activate-theme

Vendor Nayrathemes
Product Clever Fox
Weakness CWE-862 · Missing authorization
Published June 7, 2024
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

The Clever Fox – One Click Website Importer by Nayra Themes plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'clever-fox-activate-theme' function in all versions up to, and including, 25.2.0. This makes it possible for authenticated attackers, with subscriber access and above, to modify the active theme, including to an invalid value which can take down the site.

Key dates

02Disclosure timeline

June 7, 2024 CVE published
April 8, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-30809 WordPress WordPress Contact Form, Drag and Drop Form Builder Plugin – Live Forms plugin <= 4.8.4 - Settings Change vulnerability CVE-2022-45352 WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability CVE-2025-31681 Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009 CVE-2025-62944 WordPress MSTW CSV EXPORTER plugin <= 1.4 - Broken Access Control vulnerability CVE-2026-47351 TYPO3 CMS - Broken Access Control in Clipboard