Rocket Apps wProject Missing Authorization Vulnerability Allowing Unauthenticated Settings Changes

A missing authorization vulnerability has been identified in the Rocket Apps wProject WordPress theme, affecting versions prior to 5.8.0. This vulnerability allows unauthenticated users to modify settings by deleting or altering post comments and attachments.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in settings, allowing for the deletion or modification of post comments and attachments.

Remediation

Users are advised to update to version 5.8.0 or later. Patchstack has issued a virtual patch to mitigate this vulnerability until users can update.