ZoxPress WordPress Theme Missing Authorization Vulnerability Allowing Arbitrary Options Deletion

A vulnerability exists in the ZoxPress - The All-In-One WordPress News Theme for WordPress, in all versions through 2.12.0. The issue arises from a lack of proper capability checks in the 'reset_options' function, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary option values on the WordPress site. This unauthorized deletion can be exploited to remove options that, when absent, cause errors on the site, thereby disrupting service for legitimate users.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of WordPress option values, which can be used to create errors on the site and disrupt service for users.

Remediation

Users are advised to update the ZoxPress WordPress theme to version 2.12.1 or a newer patched version.