AgniHD Cartify WooCommerce Gutenberg WordPress Theme Missing Authorization Vulnerability Allowing Arbitrary Content Deletion

A missing authorization vulnerability has been identified in the AgniHD Cartify WooCommerce Gutenberg WordPress Theme, affecting versions through 1.3. This vulnerability arises from incorrectly configured access control, allowing unauthorized deletion of content such as images, posts, or pages.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of content from affected WordPress sites, including images, posts, or pages.

Remediation

Users are advised to update to a version of the AgniHD Cartify WooCommerce Gutenberg WordPress Theme that is later than 1.3. For those using Patchstack, a mitigation rule has been issued to block attacks until an official patch is available.