CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Zakra theme for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the welcome_notice_import_handler() function in all versions up to, and including, 4.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import demo settings.
Explanation of Vulnerability in Simple Terms
Zakra theme versions up to 4.1.5 lack proper authorization checks on certain administrative functions. A logged-in user with low privileges can modify site settings or data they should not have access to. The vulnerability requires an active user account but no special interaction from the victim.
What an attacker can do
Modify site settings or data without proper permission checks.
Potential impact on your site
Unauthorized users can alter site configuration or content, potentially defacing or misconfiguring your site.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
