CVE-2024-13643

Zox News <= 3.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Modification

High8.8EPSS 0.64%

Published: 11 Feb 2025
Updated: 8 Apr 2026
Reserved: 23 Jan 2025
Assigned by: Wordfence

Description

The Zox News - Professional WordPress News & Magazine Theme plugin for WordPress is vulnerable to unauthorized data modification. This vulnerability can lead to privilege escalation and denial of service conditions due to missing capability checks on the backup_options() and reset_options() functions in all versions up to and including 3.17.0. This vulnerability allows authenticated attackers with Subscriber-level access and above to update and delete arbitrary option values on the WordPress site. Attackers can exploit this issue to update the default user role for registration to Administrator and enable user registration, thereby gaining administrative access to the vulnerable site. Additionally, they could delete critical options, causing errors that may disrupt the site's functionality and deny service to legitimate users.

Scores

CVSS scores of CVE-2024-13643, by who scored it
Scored by	CVSS	Score	Vector
WordfenceCNA (assigner)	3.1	High8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Deferred	3.1	High8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.64% · top 49% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

CWE-862 Missing Authorization (opens in a new tab)All about CWE-862 and its CVEs

Affected products

MVPThemes · Zox News - Professional WordPress News & Magazine Theme
- affected ≤ 3.17.0

References (3)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2024-13643](https://trackcve.app/badge/CVE-2024-13643.svg)](https://trackcve.app/cve/CVE-2024-13643)

Record last updated 8 Apr 2026, 16:50 UTC.