OceanWP WordPress Theme Option Update Vulnerability in AJAX Handler

A vulnerability exists in the OceanWP WordPress theme in versions prior to 4.1.2, allowing authenticated users, including subscribers, to update the 'darkMode' setting. This issue arises from a missing capability check in an AJAX request handler, which fails to properly restrict access to the option update.

Impact

Exploitation of this vulnerability allows for unauthorized option updates, which could be used to change settings or configurations within the WordPress site.

Reproduction

To reproduce this vulnerability, log in as a subscriber and send a POST request to 'wp-admin/admin-ajax.php' with the action 'ocean_update_search_box_light_mode' and the 'darkMode' parameter set to the desired value. The absence of a capability check allows the option update to be processed despite the user's limited permissions.

Remediation

Users are advised to update the OceanWP WordPress theme to version 4.1.2 or later.