CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Aurum - WordPress & WooCommerce Shopping Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'lab_1cl_demo_install_package_content' function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite content with imported demo content.
Explanation of Vulnerability in Simple Terms
The Aurum WordPress theme contains a missing authorization flaw that allows authenticated users with low privileges to modify site content they should not have access to. An attacker with a basic user account can alter data through unprotected endpoints. The vulnerability affects all versions up to 4.0.2. Site owners should update to a version newer than 4.0.2 to remediate the issue.
What an attacker can do
Modify site content or settings without proper permission checks.
Potential impact on your site
Unauthorized users can alter site data, potentially defacing content or changing settings.
Conditions required to exploit
Attacker needs a low-privilege WordPress user account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
