CVE-2024-13654

High

Published: 12 February 2025

Published

12 February 2025

Modified

24 February 2025

KEV Added

—

Patch

—

CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS Score 0.0008 24.1th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-13654 is a high-severity Missing Authorization (CWE-862) vulnerability in Mvpthemes Zoxpress. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Deeper analysis

CVE-2024-13654 is a vulnerability in the ZoxPress - The All-In-One WordPress News Theme for WordPress, affecting all versions up to and including 2.12.0. It stems from a missing capability check on the 'reset_options' function (CWE-862), enabling unauthorized modification of data that can result in denial of service. The issue has a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), highlighting its high severity due to network accessibility, low complexity, and impacts on integrity and availability.

Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability remotely without user interaction. They gain the ability to delete arbitrary option values stored on the WordPress site, which can be leveraged to trigger site errors and deny service to legitimate users by disrupting critical functionality.

Advisories, including the Wordfence threat intelligence report (https://www.wordfence.com/threat-intel/vulnerabilities/id/f616be03-229b-4c50-b837-508da4d2b090?source=cve) and the theme's ThemeForest page (https://themeforest.net/item/zoxpress-allinone-wordpress-news-theme/25586170), provide further details on the issue, though specific patch information is not detailed in the CVE description. Security practitioners should monitor for updates from the theme vendor.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-51707

Vulnerability details

The ZoxPress - The All-In-One WordPress News Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'reset_options' function in all versions up…

to, and including, 2.12.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.

CWE(s): CWE-862

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1499 Endpoint Denial of Service Impact

Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.

attack.mitre.org →

Why these techniques?

Missing authorization check allows low-privileged authenticated users to delete arbitrary options on a public-facing WordPress site, directly enabling remote exploitation of the application (T1190) to achieve denial of service via data manipulation (T1499).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1