CVE-2024-11936

High

Published: 26 January 2025

Published

26 January 2025

Modified

04 February 2025

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0011 29.5th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-11936 is a high-severity Missing Authorization (CWE-862) vulnerability in Mvpthemes Zox News. Its CVSS base score is 8.8 (High).

Operationally, ranked at the 29.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations to prevent unauthorized modification of WordPress options via missing capability checks on backup_options and restore_options functions.

AC-6 Least Privilege good match

prevent

Applies least privilege to restrict subscriber-level users from escalating privileges by updating arbitrary site options like default registration roles.

SI-2 Flaw Remediation good match

prevent

Remediates the specific flaw in the Zox News theme by identifying, reporting, and patching versions up to 3.16.0 to include proper capability checks.

NVD Description

The Zox News theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'backup_options' and 'restore_options' function in all versions up to, and including, 3.16.0. This…

makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

Deeper analysisAI

CVE-2024-11936 is a vulnerability in the Zox News theme for WordPress, affecting all versions up to and including 3.16.0. It stems from a missing capability check on the 'backup_options' and 'restore_options' functions, enabling unauthorized modification of data that leads to privilege escalation. The issue is rated with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-862 (Missing Authorization).

Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction required. By calling the affected functions, they can update arbitrary WordPress site options, such as setting the default role for new user registrations to administrator and enabling registration. This allows attackers to self-register with administrative privileges, achieving full site compromise.

Advisories, including the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/3f061e7f-6a87-4d4a-9b4e-8234883f2ebc?source=cve, provide further details on the vulnerability. The theme's product page is available at https://themeforest.net/item/zox-news-professional-wordpress-news-magazine-theme/20381541.