Resido Real Estate WordPress Theme Missing Authorization Vulnerability in API Key Management

A vulnerability exists in the Resido - Real Estate WordPress Theme, affecting all versions through 3.6. The issue arises from a lack of proper capability checks on the delete_api_key and save_api_key AJAX actions. This flaw allows unauthenticated attackers to send requests to internal services, potentially manipulating API key information.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in API key settings, allowing attackers to interfere with internal services that rely on these keys.

Remediation

Users are advised to update the theme to version 3.6.1 or a later patched version.