WordPress Sparkling Theme Missing Capability Check Vulnerability Allows Unauthenticated Plugin Management
Vulnerability
A vulnerability exists in the Sparkling theme for WordPress, specifically in versions through 2.4.9. The issue arises from a lack of proper capability checks in the 'sparkling_activate_plugin' and 'sparkling_deactivate_plugin' functions. This flaw enables unauthenticated users to activate or deactivate any plugin on the site.
Impact
Exploitation of this vulnerability allows for unauthorized activation or deactivation of WordPress plugins, which could lead to a range of issues depending on the functionality of the affected plugins.
Remediation
Users can update to WordPress Sparkling theme version 2.4.10 or later to address this vulnerability.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.