Ya'aburnee <= 1.0.7 and Dignitas <= 1.1.9 - Privilege Escalation
Strategic Overview
<= 1.0.7N/AVulnerability Overview
The Ya'aburnee and Dignitas themes for WordPress are vulnerable to Privilege Escalation in versions up to, and including, 1.0.7 and 1.1.9 via the 'df_save_options' function. This makes it possible for unauthenticated attackers to escalate their privileges on the vulnerable service and gain otherwise restricted access to Admin actions.
Technical Analysis
REMEDIATION: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement. --- IDENTIFIER: CWE-269 (Improper Privilege Management) The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C