CVE-2024-12876: Uxper Golo Privilege Escalation Flaw

CVE-2024-12876 Overview

CVE-2024-12876 is a critical privilege escalation vulnerability in the Golo - City Travel Guide WordPress Theme by Uxper. The flaw affects all versions up to and including 1.6.10. The theme fails to properly validate a user's identity before updating their password. Unauthenticated attackers can change arbitrary user passwords, including those of administrators, and take over those accounts. This vulnerability maps to CWE-862: Missing Authorization and enables full site compromise without any prior access or user interaction.

Critical Impact

Unauthenticated attackers can reset any user's password, including administrator accounts, leading to complete site takeover.

Affected Products

• Uxper Golo - City Travel Guide WordPress Theme versions through 1.6.10
• WordPress installations using the Golo theme distributed via ThemeForest
• Any administrator, editor, or subscriber accounts on affected sites

Discovery Timeline

• 2025-03-07 - CVE-2024-12876 published to the National Vulnerability Database
• 2025-03-13 - Last updated in NVD database

Technical Details for CVE-2024-12876

Vulnerability Analysis

The Golo theme exposes a password update routine that does not verify the requester's identity against the account being modified. The handler accepts a target user identifier and a new password from the request, then writes the new credential directly to the user record. Because authentication and ownership checks are absent, any unauthenticated visitor can submit a request targeting a privileged account.

This is a textbook Missing Authorization flaw [CWE-862]. Password reset and update flows must enforce two controls: proof of identity through a valid session or a single-use reset token, and authorization confirming the actor owns the target account. The Golo theme enforces neither, which collapses the trust boundary between anonymous visitors and site administrators.

Once an attacker resets the administrator password, they authenticate normally through wp-login.php and gain full WordPress administrator privileges. From there, they can install malicious plugins, modify theme files, exfiltrate data, or pivot to the underlying host.

Root Cause

The root cause is the absence of nonce verification and capability checks in the password update endpoint. The handler trusts client-supplied parameters identifying which user to modify. WordPress provides check_ajax_referer(), wp_verify_nonce(), and current_user_can() for this purpose, but the vulnerable code path invokes none of them before calling wp_set_password() or an equivalent update.

Attack Vector

The attack is remote, unauthenticated, and requires no user interaction. An attacker sends a crafted HTTP POST request to the theme's password update endpoint, supplying the target user ID or login and the desired new password. The server processes the request and overwrites the credential. The attacker then logs in as the targeted account.

No exploitation code is publicly verified at the time of writing. See the Wordfence Vulnerability Report for vendor-coordinated technical details.

Detection Methods for CVE-2024-12876

Indicators of Compromise

• Unexpected password changes for administrator or editor accounts with no corresponding password reset email in logs
• New administrator accounts created shortly after suspicious POST requests to theme AJAX or admin-ajax endpoints
• Successful logins from unfamiliar IP addresses immediately following anonymous POST traffic to Golo theme endpoints
• Modified theme or plugin files, newly uploaded PHP files in wp-content/uploads/, or unscheduled cron entries

Detection Strategies

• Inspect web server access logs for unauthenticated POST requests to Golo theme handlers, particularly any endpoint containing password, reset, or update_user parameters
• Compare the user_pass column timestamps in the wp_users table against expected user-initiated reset activity
• Alert on WordPress profile_update or password_reset hooks firing without a preceding authenticated session

Monitoring Recommendations

• Forward WordPress audit logs and web server logs to a centralized SIEM for correlation across authentication, file integrity, and request telemetry
• Monitor for privilege changes and new administrator role assignments in near real time
• Track outbound connections from the web server to detect post-compromise command-and-control or data exfiltration

How to Mitigate CVE-2024-12876

Immediate Actions Required

• Update the Golo theme to a version later than 1.6.10 as soon as the vendor releases a patched build
• Force a password reset for all WordPress users, prioritizing administrator and editor accounts
• Review the wp_users table and audit logs for unauthorized password changes or new privileged accounts
• Rotate WordPress secret keys in wp-config.php and invalidate all active sessions

Patch Information

No vendor advisory URL is currently listed in the CVE record. Site owners should monitor the ThemeForest Golo product page and the Wordfence Vulnerability Report for the fixed version and apply it immediately upon release.

Workarounds

• Deploy a Web Application Firewall rule blocking unauthenticated POST requests to Golo theme password update endpoints
• Restrict access to wp-admin and theme AJAX handlers by IP allowlist where operationally feasible
• Temporarily disable the Golo theme and switch to a default WordPress theme if a patch is not yet available
• Enforce multi-factor authentication on all administrator accounts to reduce impact of credential overwrite

# Example WAF rule (ModSecurity) to block anonymous password update attempts
SecRule REQUEST_URI "@rx /wp-admin/admin-ajax\.php" \
  "chain,phase:2,deny,status:403,id:1009876,msg:'Block Golo unauth password update'"
  SecRule ARGS:action "@rx (golo_.*password|update_user_password)" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"