Flex Mag WordPress Theme Missing Authorization Vulnerability Allowing Arbitrary Option Deletion

A vulnerability exists in the Flex Mag - Responsive WordPress News Theme, all versions through 3.5.2, due to a missing capability check in the propanel_of_ajax_callback() function. This flaw allows authenticated attackers with Subscriber-level access and above to delete arbitrary option values on the WordPress site. Exploiting this vulnerability can lead to a denial-of-service condition by removing options that cause errors on the site, disrupting access for legitimate users.

Impact

Successful exploitation allows authenticated users with Subscriber-level access and above to delete arbitrary option values, potentially causing errors that disrupt service for legitimate users.

Remediation

Users are advised to update the theme to version 3.6.0 or a newer patched version.