Read the docs
TI-2024-12694 Aliases CVE-2024-13655GHSA-fqx4-gh4h-f8q5

Missing authorization in MVPThemes Flex Mag - Responsive WordPress News Theme

Priority LOW 35CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The Flex Mag - Responsive WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the propanel_of_ajax_callback() function in all versions up to, and including, 3.5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00337 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MVPThemesFlex Mag - Responsive WordPress News Themeup to 3.5.2—No fix listedCNA
  • Flex Mag - Responsive WordPress News Theme VendorMVPThemes Affected up to 3.5.2 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-13655
  2. 2026-10-03 Alias added: GHSA-fqx4-gh4h-f8q5

References

Other 2

  • TI-2026-47319 WordPress Jawn theme <= 1.4.2 - Privilege Escalation vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-12692 Missing authorization in MVPThemes ZoxPress - The All-In-One WordPress News Theme CVSS 3.1HIGH 8.8
  • TI-2024-12682 Zox News <= 3.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Modification CVSS 3.1HIGH 8.8
  • TI-2024-11073 Zox News <= 3.16.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update CVSS 3.1HIGH 8.8
  • TI-2026-47329 WordPress Reviewer plugin <= 3.14.2 - SQL Injection vulnerability CVSS 3.1HIGH 8.5
  • TI-2024-12695 Missing authorization in MVPThemes Click Mag - Viral WordPress News Magazine/Blog Theme CVSS 3.1HIGH 8.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences