CVE-2024-13654
📋 TL;DR
This vulnerability in the ZoxPress WordPress theme allows authenticated users with Subscriber-level access or higher to delete arbitrary WordPress option values. Attackers can delete critical options to cause errors and create a denial of service condition. All WordPress sites using ZoxPress theme versions up to 2.12.0 are affected.
💻 Affected Systems
- ZoxPress - The All-In-One WordPress News Theme
📦 What is this software?
Zoxpress by Mvpthemes
⚠️ Risk & Real-World Impact
Worst Case
Complete site unavailability by deleting critical WordPress options like 'siteurl' or 'home', requiring database restoration to recover.
Likely Case
Partial site functionality loss through deletion of theme-specific options, causing errors on frontend or admin areas.
If Mitigated
Minimal impact if proper user role management and monitoring are implemented.
🎯 Exploit Status
Requires authenticated access but only Subscriber-level permissions needed, which are commonly granted to site visitors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 2.12.0
Vendor Advisory: https://themeforest.net/item/zoxpress-allinone-wordpress-news-theme/25586170
Restart Required: No
Instructions:
1. Update ZoxPress theme to latest version via WordPress admin dashboard. 2. Verify theme version is above 2.12.0. 3. Clear any caching plugins/CDN caches.
🔧 Temporary Workarounds
Remove vulnerable theme
WordPressTemporarily switch to default WordPress theme until patch is applied
wp theme activate twentytwentyfour
Restrict user registration
WordPressDisable new user registration to prevent attackers from obtaining Subscriber accounts
wp option update users_can_register 0
🧯 If You Can't Patch
- Implement strict user role management and review all Subscriber-level accounts
- Enable WordPress security plugins with option change monitoring and implement regular database backups
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin dashboard > Appearance > Themes for ZoxPress theme version 2.12.0 or lowerCheck Version:
wp theme list --name=zoxpress --field=versionVerify Fix Applied:
Verify ZoxPress theme version is above 2.12.0 in WordPress admin dashboard📡 Detection & Monitoring
Log Indicators:
- WordPress option deletion events in wp_options table
- Unauthorized calls to reset_options function
- Increased error logs from missing WordPress options
Network Indicators:
- POST requests to admin-ajax.php or theme-specific endpoints with reset_options parameter
SIEM Query:
source="wordpress.log" AND ("option_name" AND "delete_option") OR ("reset_options")