WordPress Cardealer Theme Missing Authorization Vulnerability in AJAX Functions Allowing Unauthorized Data Modification and Deletion

A vulnerability exists in the Cardealer theme for WordPress, specifically in versions through 1.6.4. The issue arises from a lack of proper capability checks and filename sanitization in the demo theme scheme AJAX functions. This vulnerability enables authenticated attackers with subscriber-level access and above to unauthorizedly modify or delete arbitrary CSS and JavaScript files, leading to potential data loss and unauthorized data changes.

Impact

Exploitation of this vulnerability could result in unauthorized modification or deletion of CSS and JavaScript files, allowing for potential data loss or disruption of site functionality.

Remediation

Users are advised to update the Cardealer theme to version 1.6.5 or a newer patched version.