ThemeIsle SDK <= Various Versions - Missing Authorization

CVE	CVE-2024-1047
State	PUBLISHED
Assigner	Wordfence
Source Priority	CVE Program / NVD first with legacy fallback
Published	2024-02-02 06:15:45 UTC
Updated	2026-04-08 18:20:24 UTC
Description	Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.

Primary CVSS: v3.1 5.3 MEDIUM from [email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Problem Types: CWE-862 | CWE-862 CWE-862 Missing Authorization

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	5.3	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`
3.1	[email protected]	Secondary	5.3	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`
3.1	CNA	DECLARED	5.3	MEDIUM	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N`

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Type	Vendor	Product	Version	Update	Edition	Language
Application	Themeisle	Orbit Fox	All	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Themeisle	Menu Icons By ThemeIsle	affected 0.13.8 semver	Not specified
CNA	Themeisle	Starter Sites Templates By Neve	affected 1.2.6 semver	Not specified
CNA	Themeisle	Otter Blocks Gutenberg Blocks Page Builder For Gutenberg Editor FSE	affected 2.6.2 semver	Not specified
CNA	Themeisle	LightStart Maintenance Mode Coming Soon And Landing Page Builder	affected 2.6.9 semver	Not specified
CNA	Themeisle	Orbit Fox Duplicate Page Menu Icons SVG Support Cookie Notice Custom Fonts More	affected 2.10.28 semver	Not specified
CNA	Themeisle	Multiple Page Generator Plugin MPG	affected 3.4.0 semver	Not specified
CNA	Themeisle	Visualizer Tables And Charts Manager For WordPress	affected 3.10.6 semver	Not specified
CNA	Optimole	Optimole Optimize Images In Real Time	affected 3.12.4 semver	Not specified
CNA	Themeisle	RSS Aggregator By Feedzy Feed To Post Autoblogging News YouTube Video Feeds Aggregator	affected 4.4.1 semver	Not specified
CNA	Optimole	Super Page Cache	affected 4.7.5 semver	Not specified
CNA	Rsocial	Revive Social Social Media Auto Post And Scheduling Automation Plugin	affected 9.0.25 semver	Not specified
CNA	Themeisle	PPOM Product Addons Custom Fields For WooCommerce	affected 32.0.9 semver	Not specified

Reference	Source	Link	Tags
Orbit Fox by ThemeIsle <= 2.10.28 - Missing Authorization	af854a3a-2127-422b-91ae-364da2661108	www.wordfence.com	Third Party Advisory
403 Forbidden	af854a3a-2127-422b-91ae-364da2661108	plugins.trac.wordpress.org	Patch
403 Forbidden	af854a3a-2127-422b-91ae-364da2661108	plugins.trac.wordpress.org	Patch
plugins.trac.wordpress.org/changeset	[email protected]	plugins.trac.wordpress.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

CNA: Francesco Carlucci (en)

Source	Time	Event
CNA	2024-02-01T00:00:00.000Z	Disclosed

There are currently no legacy QID mappings associated with this CVE.