What the vulnerability does
01Description
Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_section_options', 'gsf_reset_section_options', 'gsf_create_preset_options' and more in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset and modify some of the plugin/theme settings. This issue was escalated to Envato over two months from the date of this disclosure and the issues, while partially patched, are still vulnerable.
Explanation of Vulnerability in Simple Terms
02Summary
The Benaa Framework contains a code injection vulnerability in versions up to 4.0.0. An authenticated user with low privileges can inject and execute arbitrary code through an unvalidated input field. The vulnerability requires network access and valid login credentials but no user interaction beyond the initial request. Impact is limited to data modification; confidentiality and availability are not affected.
What an attacker can do
03Attacker Capabilities
Inject and execute arbitrary code on the site if they have a low-privilege user account.
Potential impact on your site
04Site Impact
A low-privilege user account holder can modify site data or functionality through code injection.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege user account and network access to the site.
Key dates
06Disclosure timeline
May 2, 2025
CVE published
April 8, 2026
Record updated
