ColorMag WordPress Theme Missing Authorization Vulnerability in Welcome Notice Import Handler

A vulnerability exists in the ColorMag theme for WordPress, in all versions through 4.0.19, allowing unauthorized data modification. This issue arises from a missing capability check in the welcome_notice_import_handler() function. As a result, authenticated attackers with Subscriber-level access or higher can install the ThemeGrill Demo Importer plugin.

Impact

Exploitation of this vulnerability allows for unauthorized installation of the ThemeGrill Demo Importer plugin, which could be misused to import demo content or settings, potentially leading to further exploitation or disruption of the site.

Remediation

Users are advised to update the ColorMag theme to version 4.0.20 or later.