Log in Start free

Vulnerability · Published Feb 2, 2024 · Assigned by Wordfence

CVE-2024-1047ThemeIsle SDK <= Various Versions - Missing Authorization

Medium 5.3

In plain English

A medium-severity missing authorization in Optimole – Optimize Images in Real Time from optimole. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.6%top 53.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.

Affected products (as reported)

VendorProductVersions
themeisle Menu Icons by ThemeIsle 0 – through 0.13.8
themeisle Starter Sites & Templates by Neve 0 – through 1.2.6
themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE 0 – through 2.6.2
themeisle LightStart – Maintenance Mode, Coming Soon and Landing Page Builder 0 – through 2.6.9
themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More 0 – through 2.10.28
themeisle Multiple Page Generator Plugin – MPG 0 – through 3.4.0
themeisle Visualizer: Tables and Charts Manager for WordPress 0 – through 3.10.6
optimole Optimole – Optimize Images in Real Time 0 – through 3.12.4
themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator 0 – through 4.4.1
optimole Super Page Cache 0 – through 4.7.5
rsocial Revive Social – Social Media Auto Post and Scheduling Automation Plugin 0 – through 9.0.25
themeisle PPOM – Product Addons & Custom Fields for WooCommerce 0 – through 32.0.9

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References