CVE-2024-13653: Zoxpress Privilege Escalation Vulnerability

CVE-2024-13653 Overview

CVE-2024-13653 affects the ZoxPress All-In-One WordPress News Theme in all versions up to and including 2.12.0. The vulnerability stems from missing capability checks on the backup_options and restore_options functions. Authenticated attackers with Subscriber-level access can update arbitrary WordPress options. Attackers leverage this to set the default registration role to administrator and enable open user registration. The result is full administrative access to the affected WordPress site. The flaw is classified as CWE-862: Missing Authorization.

Critical Impact
Any authenticated subscriber can escalate to WordPress administrator by modifying site options through unprotected backup and restore endpoints.

Affected Products

ZoxPress All-In-One WordPress News Theme versions ≤ 2.12.0
WordPress installations using the mvpthemes ZoxPress theme
Sites with open or authenticated subscriber registration enabled

Discovery Timeline

2025-02-12 - CVE-2024-13653 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13653

Vulnerability Analysis

The ZoxPress theme exposes two administrative helper functions, backup_options and restore_options, through AJAX handlers. These functions read and write WordPress options but do not verify the caller's capabilities. WordPress requires a current_user_can() check to gate administrative actions, and this check is absent. As a result, any authenticated session, including a Subscriber account, can invoke the handlers.

An attacker uses restore_options to overwrite critical WordPress settings. Setting users_can_register to 1 opens registration, and setting default_role to administrator grants new accounts full site control. The attacker then registers a new user and inherits administrator privileges.

Root Cause

The root cause is a missing authorization check [CWE-862] on privileged AJAX actions. The handlers rely on authentication alone and treat any logged-in user as trusted. Nonce validation, if present, does not substitute for a capability check because low-privilege users receive valid nonces through the admin-ajax interface.

Attack Vector

The attack requires network access and a Subscriber-level account on the target site. The attacker sends a crafted POST request to wp-admin/admin-ajax.php invoking the restore_options action with a payload that modifies users_can_register and default_role. After the options update, the attacker registers a new account through wp-login.php?action=register and is provisioned as an administrator.

No user interaction is required beyond the attacker's own actions. Sites that allow self-service subscriber registration are exposed to unauthenticated actors who first register a subscriber account, then execute the escalation.

See the Wordfence Vulnerability Report for additional technical detail on the affected handlers.

Detection Methods for CVE-2024-13653

Indicators of Compromise

Unexpected changes to the users_can_register and default_role WordPress options
New administrator accounts created shortly after subscriber account registration
POST requests to admin-ajax.php with action=restore_options or action=backup_options originating from non-admin sessions
WordPress audit log entries showing option updates by low-privilege user IDs

Detection Strategies

Monitor the wp_options table for modifications to default_role, users_can_register, siteurl, and home values
Alert on any HTTP request to admin-ajax.php containing restore_options or backup_options action parameters
Correlate new user registrations with recent option changes within short time windows
Deploy a WordPress activity logging plugin to record capability-sensitive actions and user role changes

Monitoring Recommendations

Ingest WordPress access logs and PHP application logs into a centralized SIEM for correlation
Baseline normal administrator account creation patterns and alert on deviations
Review theme and plugin AJAX endpoints periodically for missing capability checks
Track outbound requests from the WordPress host that indicate post-compromise activity such as webshell installation

How to Mitigate CVE-2024-13653

Immediate Actions Required

Update the ZoxPress theme to a version later than 2.12.0 as soon as the vendor releases a patched build
Audit all WordPress user accounts and remove any unauthorized administrator accounts
Verify that users_can_register and default_role reflect intended values in the WordPress General Settings
Rotate credentials for existing administrator accounts and enforce multi-factor authentication

Patch Information

At the time of publication, no vendor advisory URL is listed in the NVD entry. Site owners should consult the ThemeForest ZoxPress listing and the Wordfence advisory for the latest fixed version. Until a patched release is confirmed, treat all installations of version 2.12.0 and earlier as vulnerable.

Workarounds

Disable the ZoxPress theme and switch to a default WordPress theme until a patch is available
Block requests to admin-ajax.php containing restore_options or backup_options actions at the web application firewall
Restrict subscriber-level registration on the site to reduce the population of accounts that can trigger the vulnerability
Apply a WordPress must-use plugin that intercepts the vulnerable AJAX actions and enforces a current_user_can('manage_options') check

bash

# Example WAF rule (ModSecurity) blocking the vulnerable AJAX actions
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1013653,\
   msg:'CVE-2024-13653 ZoxPress option tampering attempt'"
  SecRule ARGS:action "@rx ^(backup_options|restore_options)$" \
    "t:none,t:lowercase"