Read the docs
TI-2024-12682 Aliases CVE-2024-13643GHSA-3h9j-fvqm-h724

Zox News <= 3.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Modification

Priority MEDIUM 41CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The Zox News - Professional WordPress News & Magazine Theme plugin for WordPress is vulnerable to unauthorized data modification. This vulnerability can lead to privilege escalation and denial of service conditions due to missing capability checks on the backup_options() and reset_options() functions in all versions up to and including 3.17.0. This vulnerability allows authenticated attackers with Subscriber-level access and above to update and delete arbitrary option values on the WordPress site. Attackers can exploit this issue to update the default user role for registration to Administrator and enable user registration, thereby gaining administrative access to the vulnerable site. Additionally, they could delete critical options, causing errors that may disrupt the site's functionality and deny service to legitimate users.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00641 50th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MVPThemesZox News - Professional WordPress News & Magazine Themeup to 3.17.0—No fix listedCNA
  • Zox News - Professional WordPress News & Magazine Theme VendorMVPThemes Affected up to 3.17.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-13643
  2. 2026-10-03 Alias added: GHSA-3h9j-fvqm-h724
  3. 2026-10-21 EPSS moved to the 50th–90th percentile

References

Other 3

  • TI-2026-47319 WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-12692 Missing authorization in MVPThemes ZoxPress - The All-In-One WordPress News Theme CVSS 3.1HIGH 8.8
  • TI-2024-11073 Zox News <= 3.16.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update CVSS 3.1HIGH 8.8
  • TI-2026-47329 WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability CVSS 3.1HIGH 8.5
  • TI-2024-12695 Missing authorization in MVPThemes Click Mag - Viral WordPress News Magazine/Blog Theme CVSS 3.1HIGH 8.1
  • TI-2024-12694 Missing authorization in MVPThemes Flex Mag - Responsive WordPress News Theme CVSS 3.1HIGH 8.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences