CVE-2024-1388 Yuki <= 1.3.13 - Missing Authorization to Authenticated (Subscriber+) Theme Setting Reset

The Yuki theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the resetcustomizeroptions function in all versions up to, and including, 1.3.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to res...

CVE-2024-1388

CVE-2024-1388 affects the Yuki WordPress theme. Root cause: missing capability check in reset_customizer_options(), affecting all versions up to and including 1.3.13. Impact: authenticated users with subscriber+ can reset the theme settings, enabling unauthorized modification of data. Remediation...

WordPress Yuki Theme <= 1.3.13 is vulnerable to Broken Access Control

Software Yuki Type Theme Vulnerable versions = 1.3.13 Fixed in 1.3.14 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1388 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID bc04919f893e Credits Lucio Sá Required privilege Subscriber...