Zox News WordPress Theme Missing Authorization Vulnerability in Options Update

A vulnerability exists in the Zox News theme for WordPress, all versions through 3.16.0, allowing unauthorized data modification that could lead to privilege escalation. This issue arises from a lack of capability checks in the 'backup_options' and 'restore_options' functions. As a result, authenticated attackers with Subscriber-level access or higher can manipulate arbitrary options on the WordPress site. This vulnerability could be exploited to change the default registration role to administrator and enable user registration, granting administrative access to the attacker on the compromised site.

Impact

Exploitation of this vulnerability could allow authenticated users with Subscriber-level access to gain administrative privileges on the WordPress site by manipulating user roles and options.

Remediation

Users are advised to update the Zox News WordPress theme to version 3.17.0 or a newer patched version.