CVE-2024-13643 Overview
CVE-2024-13643 affects the Zox News Professional WordPress News & Magazine Theme. The vulnerability exists in all versions up to and including 3.17.0. Missing capability checks on the backup_options() and reset_options() functions allow authenticated attackers with Subscriber-level access to modify and delete arbitrary WordPress option values. Attackers can escalate privileges by changing the default registration role to Administrator and enabling open user registration. Alternatively, attackers can delete critical options to cause site-wide denial of service. The vulnerability maps to [CWE-862] Missing Authorization.
Critical Impact
Authenticated attackers with minimal Subscriber privileges can escalate to Administrator or take the entire WordPress site offline.
Affected Products
- Zox News – Professional WordPress News & Magazine Theme versions ≤ 3.17.0
- WordPress installations running the vulnerable theme with open user registration or any Subscriber+ account
- Sites distributed via ThemeForest Zox News Theme
Discovery Timeline
- 2025-02-11 - CVE-2024-13643 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13643
Vulnerability Analysis
The Zox News theme exposes two administrative functions, backup_options() and reset_options(), without proper capability verification. WordPress uses the current_user_can() check to enforce role-based access control on privileged actions. The vulnerable functions omit this check, treating any authenticated request as authorized. Attackers gain the ability to read, write, and delete any entry in the WordPress wp_options table.
The exposure covers two abuse paths. First, attackers can rewrite default_role to administrator and enable users_can_register, then register a new administrator account through the standard signup flow. Second, attackers can delete or corrupt options such as siteurl, home, template, or active_plugins, breaking the site until an operator restores the database.
Root Cause
The root cause is missing authorization on privileged theme endpoints. Neither backup_options() nor reset_options() verifies the caller's capabilities before acting on the options table. Nonce validation, if present, does not substitute for capability checks because Subscriber accounts can generate valid nonces.
Attack Vector
Exploitation requires an authenticated session at Subscriber level or higher. Many WordPress sites accept open registration or expose Subscriber roles through membership plugins, lowering the bar for attackers. The attack is remote, network-based, and requires no user interaction beyond the attacker's own authenticated request. See the Wordfence Vulnerability Analysis for additional technical detail.
The vulnerability manifests when Subscriber-level requests reach the unprotected option-modification handlers. No verified public exploit code is available at this time.
Detection Methods for CVE-2024-13643
Indicators of Compromise
- Unexpected changes to the default_role option, particularly a value of administrator
- The users_can_register option flipped to 1 on sites that previously disabled registration
- New administrator accounts created shortly after Subscriber logins from unfamiliar IP addresses
- Missing or emptied core options such as siteurl, home, or active_plugins producing site errors
Detection Strategies
- Audit the WordPress wp_options table for changes to default_role, users_can_register, and other security-sensitive keys
- Enable WordPress activity logging to capture option modifications tied to user IDs and session data
- Review web server access logs for POST requests from Subscriber accounts to Zox News admin-ajax or theme endpoints
Monitoring Recommendations
- Alert on any privilege change that promotes a non-administrator account to the administrator role
- Monitor the user registration table for accounts created outside normal business patterns
- Track theme and plugin file integrity to detect follow-on webshell deployment after privilege escalation
How to Mitigate CVE-2024-13643
Immediate Actions Required
- Update the Zox News theme to a version later than 3.17.0 once the vendor releases a patched build
- Disable open user registration on WordPress sites until the theme is updated
- Review existing Subscriber and Contributor accounts and remove any unrecognized users
- Reset credentials for all administrator accounts and enforce multi-factor authentication
Patch Information
Refer to the MVP Themes Zox News Resource and ThemeForest Zox News Theme pages for updated releases addressing the missing authorization checks in backup_options() and reset_options(). Confirm the installed version through the WordPress admin dashboard under Appearance → Themes.
Workarounds
- Deactivate the Zox News theme and switch to a default WordPress theme until a patched version is available
- Restrict access to wp-admin and admin-ajax.php using web server rules or a web application firewall
- Set default_role explicitly to subscriber and monitor the value for unauthorized changes
- Disable user registration by unchecking Settings → General → Anyone can register
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
