CVE-2024-13654

High

Published: 12 February 2025

Published

12 February 2025

Modified

24 February 2025

KEV Added

—

Patch

—

CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS Score 0.0008 23.9th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13654 is a high-severity Missing Authorization (CWE-862) vulnerability in Mvpthemes Zoxpress. Its CVSS base score is 8.1 (High).

Operationally, ranked at the 23.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations to prevent unauthorized access to the reset_options function due to the missing capability check.

AC-6 Least Privilege good match

prevent

Implements least privilege to restrict subscriber-level users from deleting arbitrary option values that could cause denial of service.

SI-2 Flaw Remediation good match

prevent

Provides timely remediation of the specific flaw in the ZoxPress theme by identifying, reporting, and patching the vulnerability.

NVD Description

The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'reset_options' function in all versions up…

to, and including, 2.12.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.

Deeper analysisAI

CVE-2024-13654 is a vulnerability in the ZoxPress - The All-In-One WordPress News Theme for WordPress, affecting all versions up to and including 2.12.0. It stems from a missing capability check on the 'reset_options' function (CWE-862), enabling unauthorized modification of data that can result in denial of service. The issue has a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), highlighting its high severity due to network accessibility, low complexity, and impacts on integrity and availability.

Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability remotely without user interaction. They gain the ability to delete arbitrary option values stored on the WordPress site, which can be leveraged to trigger site errors and deny service to legitimate users by disrupting critical functionality.

Advisories, including the Wordfence threat intelligence report (https://www.wordfence.com/threat-intel/vulnerabilities/id/f616be03-229b-4c50-b837-508da4d2b090?source=cve) and the theme's ThemeForest page (https://themeforest.net/item/zoxpress-allinone-wordpress-news-theme/25586170), provide further details on the issue, though specific patch information is not detailed in the CVE description. Security practitioners should monitor for updates from the theme vendor.