WordPress Spacious Theme Missing Authorization Vulnerability in Demo Data Import

A vulnerability exists in the Spacious theme for WordPress, in all versions through 1.9.11, allowing unauthorized data modification. The issue arises from a lack of capability checks in the 'welcome_notice_import_handler' function. This flaw enables authenticated attackers with Subscriber-level access or higher to import demo data into their sites.

Impact

Exploitation of this vulnerability allows for unauthorized importation of demo data by authenticated users with Subscriber-level access or above.

Remediation

Users can update to version 1.9.12 or a newer patched version to address this vulnerability.