CVE-2024-6987
📋 TL;DR
The Orchid Store WordPress theme has a missing capability check that allows authenticated users with Subscriber-level access or higher to activate the Addonify Floating Cart For WooCommerce plugin. This vulnerability affects all versions up to and including 1.5.6, enabling unauthorized plugin activation.
💻 Affected Systems
- Orchid Store WordPress Theme
📦 What is this software?
Orchid Store by Themebeez
⚠️ Risk & Real-World Impact
Worst Case
An attacker could activate malicious plugins, potentially leading to privilege escalation, data theft, or site compromise if other vulnerable plugins are present.
Likely Case
Unauthorized activation of the Addonify Floating Cart plugin, which could disrupt e-commerce functionality or enable further attacks through that plugin's vulnerabilities.
If Mitigated
Minimal impact if proper user role management and plugin security controls are in place.
🎯 Exploit Status
Exploitation requires authenticated access with at least Subscriber privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.7
Vendor Advisory: https://themes.trac.wordpress.org/changeset/237704/
Restart Required: No
Instructions:
1. Update Orchid Store theme to version 1.5.7 or later via WordPress admin panel. 2. Verify the update completed successfully. 3. Test theme functionality.
🔧 Temporary Workarounds
Remove vulnerable theme
allTemporarily switch to a different WordPress theme until patched.
wp theme activate twentytwentyfour
Restrict user roles
allLimit Subscriber-level user creation and review existing accounts.
🧯 If You Can't Patch
- Disable the Orchid Store theme and use an alternative theme.
- Remove or restrict the Addonify Floating Cart plugin to prevent activation.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel for Orchid Store theme version 1.5.6 or earlier.Check Version:
wp theme list --field=name,version | grep orchid-storeVerify Fix Applied:
Confirm Orchid Store theme is updated to version 1.5.7 or later in WordPress themes list.📡 Detection & Monitoring
Log Indicators:
- WordPress logs showing plugin activation by Subscriber-level users
- Unexpected activation of Addonify Floating Cart plugin
Network Indicators:
- HTTP POST requests to theme activation endpoints from low-privilege accounts
SIEM Query:
source="wordpress" action="plugin_activated" user_role="subscriber"