CVE-2024-12920: FoodBakery WordPress Theme Auth Bypass

CVE-2024-12920 Overview

CVE-2024-12920 affects the FoodBakery Delivery Restaurant Directory WordPress theme in all versions up to and including 4.7. The vulnerability stems from missing capability checks on eight AJAX functions, including foodbakery_var_backup_file_delete, foodbakery_widget_file_delete, theme_option_save, export_widget_settings, ajax_import_widget_data, foodbakery_var_settings_backup_generate, foodbakery_var_backup_file_restore, and theme_option_rest_all. Authenticated attackers with Subscriber-level access or above can abuse these endpoints to delete arbitrary files, modify theme options, export or import widget data, generate and restore backups, and reset theme configurations.

Critical Impact
Any authenticated user, including low-privileged Subscribers, can delete arbitrary files on the server and modify theme configuration, potentially leading to site takeover.

Affected Products

FoodBakery | Delivery Restaurant Directory WordPress Theme versions ≤ 4.7
WordPress installations running the vulnerable theme
Restaurant and delivery directory sites using FoodBakery

Discovery Timeline

2025-03-19 - CVE-2024-12920 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-12920

Vulnerability Analysis

The FoodBakery theme registers multiple AJAX handlers that execute privileged administrative operations. These handlers do not verify whether the calling user holds the appropriate WordPress capability, such as manage_options or edit_theme_options. WordPress treats any logged-in user, including Subscribers, as authenticated for AJAX endpoints registered through wp_ajax_* hooks. Because the handlers rely solely on authentication status rather than capability verification, low-privileged users can invoke administrative functions directly.

An attacker with a Subscriber account can send crafted AJAX requests to endpoints such as foodbakery_var_backup_file_delete to remove backup files or foodbakery_widget_file_delete to delete arbitrary files that the web server user can access. Deleting critical files like wp-config.php can force WordPress into a setup state, enabling attackers to reconfigure the site to point at their own database and achieve full compromise.

Root Cause

The vulnerability maps to CWE-862: Missing Authorization. The affected functions do not call current_user_can() or an equivalent capability check before performing sensitive operations. Registration is required, but registration alone should never authorize file deletion or theme modification.

Attack Vector

Exploitation requires network access to the target WordPress site and a valid Subscriber-level or higher account. Attackers submit POST requests to /wp-admin/admin-ajax.php with the action parameter set to one of the eight vulnerable function names. The vulnerable code paths execute without validating the caller's role, granting attackers the ability to modify theme options, reset configuration, or delete files on the underlying filesystem.

See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-12920

Indicators of Compromise

Unexpected POST requests to /wp-admin/admin-ajax.php with action values matching the eight vulnerable function names, originating from Subscriber accounts
Missing or modified theme configuration files, deleted backup archives, or reset theme options
New Subscriber account registrations followed shortly by AJAX activity against theme endpoints
Modified wp_options entries for FoodBakery theme configuration keys

Detection Strategies

Inspect web server access logs for admin-ajax.php requests carrying the vulnerable action parameters and correlate the requesting user ID against WordPress role assignments
Enable WordPress audit logging plugins to record theme option changes, file deletions, and backup operations with attribution to originating accounts
Alert on any file deletion under the WordPress installation directory that is not initiated by an administrator session

Monitoring Recommendations

Baseline normal AJAX traffic patterns for the site and flag Subscriber-role requests to administrative action endpoints
Monitor for new user registrations combined with immediate use of theme AJAX endpoints, a common exploitation signature
Track filesystem integrity for WordPress core files, theme directories, and backup locations using file integrity monitoring

How to Mitigate CVE-2024-12920

Immediate Actions Required

Update the FoodBakery theme to a version later than 4.7 once the vendor releases a patched build
Disable open user registration on WordPress sites running FoodBakery until patched, reducing the pool of accounts that can exploit the flaw
Audit existing Subscriber and higher-privileged accounts for suspicious recent activity and remove unrecognized accounts
Restore known-good copies of theme configuration and backup files if tampering is suspected

Patch Information

No fixed version is listed in the NVD entry at publication. Site operators should consult the ThemeForest product page for update availability and monitor the Wordfence advisory for confirmation of a patched release.

Workarounds

Restrict access to /wp-admin/admin-ajax.php at the web application firewall layer by blocking requests where the action parameter matches the eight vulnerable function names
Set users_can_register to false in WordPress General Settings to prevent unauthenticated attackers from creating Subscriber accounts
Deploy a virtual patch through a WAF that enforces capability checks before proxying requests to the vulnerable endpoints

bash

# Example WAF rule pattern (ModSecurity) to block Subscriber-level access to vulnerable actions
SecRule ARGS:action "@rx ^(foodbakery_var_backup_file_delete|foodbakery_widget_file_delete|theme_option_save|export_widget_settings|ajax_import_widget_data|foodbakery_var_settings_backup_generate|foodbakery_var_backup_file_restore|theme_option_rest_all)$" \
    "id:1029120,phase:2,deny,status:403,log,msg:'CVE-2024-12920 FoodBakery vulnerable AJAX action blocked'"