Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2024-1047

ThemeIsle SDK <= Various Versions - Missing Authorization

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Wordfence

Description

Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

themeisle Menu Icons by ThemeIsle

Default version status: unaffected

  • 0 to ≤ 0.13.8affected

themeisle Starter Sites & Templates by Neve

Default version status: unaffected

  • 0 to ≤ 1.2.6affected

themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE

Default version status: unaffected

  • 0 to ≤ 2.6.2affected

themeisle LightStart – Maintenance Mode, Coming Soon and Landing Page Builder

Default version status: unaffected

  • 0 to ≤ 2.6.9affected

themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More

Default version status: unaffected

  • 0 to ≤ 2.10.28affected

themeisle Multiple Page Generator Plugin – MPG

Default version status: unaffected

  • 0 to ≤ 3.4.0affected

themeisle Visualizer: Tables and Charts Manager for WordPress

Default version status: unaffected

  • 0 to ≤ 3.10.6affected

optimole Optimole – Optimize Images in Real Time

Default version status: unaffected

  • 0 to ≤ 3.12.4affected

themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator

Default version status: unaffected

  • 0 to ≤ 4.4.1affected

optimole Super Page Cache

Default version status: unaffected

  • 0 to ≤ 4.7.5affected

rsocial Revive Social – Social Media Auto Post and Scheduling Automation Plugin

Default version status: unaffected

  • 0 to ≤ 9.0.25affected

themeisle PPOM – Product Addons & Custom Fields for WooCommerce

Default version status: unaffected

  • 0 to ≤ 32.0.9affected

References