Skip to content
Sign in
4.3 Medium

CVE-2024-1388 The Yuki theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the…

Description

The Yuki theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_customizer_options() function in all versions up to, and including, 1.3.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to reset the theme's settings.

Affected products and versions

Product Affected versions Fixed in
Yuki 1.3 earliest → 1.3.13 No fix stated

Other CVEs of Yuki

The 2 CVEs of Yuki →
CVE-2024-1943 The Yuki theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including 1.3.14 4.3 Medium
Track this CVE