WordPress Altair Theme Privilege Escalation Vulnerability

A vulnerability in the Altair theme for WordPress, present in all versions through 5.2.4, allows for unauthorized data modification that could lead to privilege escalation. This issue arises from a missing capability check in the theme's functions.php file, enabling unauthenticated attackers to update arbitrary options on the WordPress site. Exploitation of this vulnerability could involve changing the default role for new users to administrator and activating user registration, thereby granting administrative access to the attacker on the compromised site.

Impact

Exploitation of this vulnerability could allow an attacker to gain administrative privileges on the WordPress site.

Remediation

Users are advised to update the Altair theme to version 5.2.5 or a newer patched version.