CVE-2024-13654: Mvpthemes Zoxpress Auth Bypass Vulnerability

CVE-2024-13654 Overview

CVE-2024-13654 is a missing authorization vulnerability [CWE-862] in the ZoxPress WordPress theme by mvpthemes. The flaw affects all versions up to and including 2.12.0. The reset_options function lacks a capability check, allowing authenticated attackers with Subscriber-level access to delete arbitrary WordPress option values. Attackers can leverage this to remove critical options and trigger site errors, denying service to legitimate users.

Critical Impact
Authenticated Subscriber-level users can delete arbitrary WordPress site options, causing site-wide denial of service and integrity loss.

Affected Products

ZoxPress - The All-In-One WordPress News Theme
All versions up to and including 2.12.0
WordPress installations using the mvpthemes ZoxPress theme

Discovery Timeline

2025-02-12 - CVE-2024-13654 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13654

Vulnerability Analysis

The vulnerability resides in the ZoxPress theme's reset_options function. WordPress themes commonly expose administrative AJAX endpoints for configuration management. These endpoints must verify the requesting user's role and capabilities before performing state-changing operations.

In ZoxPress version 2.12.0 and earlier, the reset_options function does not call current_user_can() or an equivalent capability check. Any authenticated session — including a low-privilege Subscriber account — can invoke the handler and instruct WordPress to delete option values from the wp_options table.

WordPress subscriber registration is enabled by default on many blogs and news sites, making this attack path broadly reachable. The impact reaches beyond configuration tampering: deleting core options such as siteurl, home, template, or stylesheet breaks page rendering and leaves the site inaccessible.

Root Cause

The root cause is a missing authorization check [CWE-862] on a privileged action handler. The function trusts any authenticated request without validating that the caller holds an administrative capability such as manage_options.

Attack Vector

An attacker registers or compromises a Subscriber-level account on the target WordPress site. The attacker then sends a crafted request to the theme's AJAX endpoint that invokes reset_options with an option name of their choice. WordPress deletes the option, and subsequent page loads fail if the option is required for rendering.

The vulnerability is exploitable over the network with low complexity and low privileges, requiring no user interaction. See the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2024-13654

Indicators of Compromise

Unexpected HTTP POST requests to admin-ajax.php referencing the reset_options action from non-administrator sessions
Missing or NULL entries for core WordPress options such as siteurl, home, template, or active_plugins in the wp_options table
Sudden site outages or white-screen errors following a spike in Subscriber account activity
New Subscriber-level account registrations followed shortly by AJAX requests to theme endpoints

Detection Strategies

Inspect web server access logs for POST requests to wp-admin/admin-ajax.php where the action parameter targets ZoxPress reset handlers
Correlate authenticated non-admin sessions with any option-deletion database events
Audit the wp_options table integrity against known-good backups to identify deleted rows
Monitor WordPress error logs for missing option warnings that indicate tampering

Monitoring Recommendations

Enable database change auditing on the wp_options table with alerts on DELETE operations
Track Subscriber-role account creation velocity and flag anomalous registration bursts
Alert on HTTP 500 responses correlated with prior AJAX activity from low-privilege users

How to Mitigate CVE-2024-13654

Immediate Actions Required

Update the ZoxPress theme to a version newer than 2.12.0 once the vendor releases a patched build
Audit all WordPress user accounts and remove unnecessary Subscriber-level accounts
Disable open user registration by unchecking "Anyone can register" under WordPress general settings if not required
Restore any missing wp_options entries from a recent verified backup

Patch Information

At the time of publication, no fixed version is listed in the NVD entry. Site owners should monitor the ThemeForest Product Page and the Wordfence Vulnerability Analysis for release notes covering the reset_options capability check fix.

Workarounds

Restrict access to wp-admin/admin-ajax.php at the web application firewall (WAF) layer for the vulnerable action parameter values
Temporarily switch to a different theme until a patched ZoxPress version is available
Enforce strong authentication and CAPTCHA on the WordPress registration form to slow attacker account creation
Regularly export the wp_options table so deleted values can be restored quickly

bash

# Disable open registration via wp-cli as a temporary containment step
wp option update users_can_register 0

# Back up the wp_options table for rapid restoration
wp db export --tables=wp_options wp_options_backup.sql