Skip to content
Sign in
5.3 Medium

CVE-2024-13423 The Sparkling theme for WordPress is vulnerable to unauthorized plugin activation/deactivation due to a missing…

Description

The Sparkling theme for WordPress is vulnerable to unauthorized plugin activation/deactivation due to a missing capability check on the 'sparkling_activate_plugin' and 'sparkling_deactivate_plugin' functions in versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to activate/deactivate arbitrary plugins.

Affected products and versions

Product Affected versions Fixed in
Sparkling 2.4 earliest → 2.4.9 No fix stated

Other CVEs of Sparkling

The 2 CVEs of Sparkling →
CVE-2020-36708 The following themes for WordPress are vulnerable to Function Injections in versions up to and including… 9.8 Critical
Track this CVE