CVE-2024-13656: Click Mag WordPress Theme DOS Vulnerability

CVE-2024-13656 Overview

CVE-2024-13656 affects the Click Mag WordPress theme by mvpthemes, a commercial news magazine and blog theme distributed through ThemeForest. The vulnerability exists in the propanel_of_ajax_callback() function, which lacks a capability check across all versions up to and including 3.6.0. Authenticated users with subscriber-level access or higher can invoke the function to delete arbitrary WordPress option values. Deleting critical option values corrupts site configuration and produces errors that deny service to legitimate visitors. The flaw is classified under CWE-862: Missing Authorization.

Critical Impact
Any authenticated subscriber can delete arbitrary WordPress options, breaking site functionality and rendering the site inaccessible to legitimate users.

Affected Products

mvpthemes Click Mag theme versions up to and including 3.6.0
WordPress installations using the Click Mag - Viral WordPress News Magazine/Blog Theme
Any WordPress site accepting subscriber-level registrations while running vulnerable Click Mag versions

Discovery Timeline

2025-02-12 - CVE-2024-13656 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13656

Vulnerability Analysis

The Click Mag theme registers the propanel_of_ajax_callback() function as a handler for WordPress AJAX requests. WordPress exposes AJAX callbacks through the /wp-admin/admin-ajax.php endpoint, which authenticated users of any role can reach. The vulnerable handler processes requests without verifying that the caller holds an administrative capability such as manage_options.

Because the function operates on WordPress option values through the delete_option() API, an attacker can supply arbitrary option names as parameters. WordPress options control site title, active theme, permalink structure, home URL, and countless plugin settings. Removing any of these values can trigger fatal errors, redirect loops, or blank pages that block legitimate access.

Root Cause

The root cause is a missing authorization check inside the AJAX callback. WordPress AJAX handlers registered under the wp_ajax_ prefix are accessible to every authenticated user, including subscribers. Secure implementations must call current_user_can() with an appropriate capability and validate a nonce through check_ajax_referer(). The Click Mag callback performs neither check before executing the option deletion.

Attack Vector

Exploitation requires network access to the WordPress AJAX endpoint and a valid authenticated session at subscriber level or higher. Many WordPress sites allow open user registration, giving unauthenticated attackers a path to obtain the required session. Once authenticated, the attacker issues a crafted POST request to admin-ajax.php specifying the vulnerable action and the target option name. No user interaction is required from an administrator.

See the Wordfence Vulnerability Report for additional analysis.

Detection Methods for CVE-2024-13656

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php invoking the propanel_of AJAX action from low-privileged accounts
Sudden site errors, blank pages, or home and siteurl option changes without corresponding administrator activity
Unexpected entries in WordPress debug logs referencing missing or undefined option keys
Newly registered subscriber accounts generating AJAX traffic shortly after account creation

Detection Strategies

Monitor web server logs for repeated POST requests to admin-ajax.php containing the vulnerable action name
Alert on option deletions in the wp_options table using database auditing or a WordPress activity log plugin
Correlate authenticated AJAX activity with the requesting user role, flagging option-modifying calls from non-administrators

Monitoring Recommendations

Enable WordPress activity logging to capture option changes, user role changes, and AJAX action invocations
Forward web and application logs to a centralized SIEM or data lake for behavioral analysis and long-term retention
Track EPSS movement for CVE-2024-13656 to reprioritize patching as exploitation likelihood shifts

How to Mitigate CVE-2024-13656

Immediate Actions Required

Update the Click Mag theme to a version later than 3.6.0 as soon as the vendor releases a patched build
Restrict or disable open user registration until the theme is updated, reducing the pool of authenticated attackers
Audit the wp_options table and back up the database before applying changes so option values can be restored
Review recently created subscriber accounts and remove any that are unrecognized

Patch Information

No fixed version is listed in the NVD entry at time of publication. Site owners should monitor the ThemeForest Click Mag Theme product page and the Wordfence Vulnerability Report for update announcements. Apply the vendor patch immediately once available.

Workarounds

Deploy a web application firewall rule that blocks unauthenticated and subscriber-level POST requests targeting the vulnerable AJAX action
Change default user role for new registrations away from Subscriber, or set users_can_register to false in WordPress settings
Switch to an alternate theme until a fixed version of Click Mag is released
Implement scheduled database backups so option deletions can be reverted quickly

bash

# Disable open registration and harden the AJAX endpoint in wp-config.php / .htaccess
wp option update users_can_register 0

# Example Apache rule to block the vulnerable action for non-admin users
# (place in .htaccess above WordPress rules)
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{REQUEST_URI} /wp-admin/admin-ajax\.php$
  RewriteCond %{QUERY_STRING} action=propanel_of [NC,OR]
  RewriteCond %{THE_REQUEST} "action=propanel_of" [NC]
  RewriteRule .* - [F,L]
</IfModule>