CVE-2024-12855

Name of the Vulnerable Software and Affected Versions AdForest theme for WordPress versions up to and including 5.1.7

Description The issue concerns unauthorized modification of data due to a missing capability check on several AJAX actions, such as the sb remove ad action. This allows authenticated attackers with Subscriber-level access or higher to delete posts, attachments, and deactivate a license.

Recommendations For AdForest theme for WordPress versions up to and including 5.1.7, update to a version higher than 5.1.7 to resolve the issue. As a temporary workaround, consider restricting access to the sb remove ad AJAX action until a patch is available. Restrict access to sensitive data and functionality for users with Subscriber-level access and above to minimize the risk of exploitation.