Vulnerability · Published Mar 27, 2024 · Assigned by Wordfence

CVE-2024-2962Networker - Tech News WordPress Theme with Dark Mode <= 1.1.9 - Missing Authorization

Medium 5.3

In plain English

A medium-severity missing authorization in Networker - Tech News WordPress Theme with Dark Mode from codesupplyco. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.5%top 56.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Networker - Tech News WordPress Theme with Dark Mode theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_reload_nav_menu() function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to modify the location of display menus.

Affected products (as reported)

Vendor	Product	Versions
codesupplyco	Networker - Tech News WordPress Theme with Dark Mode	0 – through 1.1.9

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

In plain English

Official description

Affected products (as reported)

References