Eco Nature WordPress Theme Missing Authorization Vulnerability Allowing Denial-of-Service

A denial-of-service vulnerability has been identified in the Eco Nature - Environment & Ecology WordPress Theme, all versions through 2.0.4. The issue arises from a missing capability check on the 'cmsmasters_hide_admin_notice' AJAX action, allowing authenticated attackers with Subscriber-level access and above to unauthorizedly modify option values. This manipulation can lead to errors on the site, disrupting service for legitimate users, or be used to alter certain values, such as registration settings.

Impact

Exploitation of this vulnerability can cause errors on the WordPress site, disrupting service for legitimate users. Additionally, it can be used to manipulate option values related to user registration.

Remediation

Users are advised to update the Eco Nature WordPress Theme to version 2.1.0 or a newer patched version.