CVE-2024-1388

Name of the Vulnerable Software and Affected Versions Yuki theme for WordPress versions up to, and including, 1.3.13

Description The issue allows authenticated attackers with subscriber-level access and above to reset the theme's settings due to a missing capability check on the reset customizer options() function. This enables unauthorized modification of data.

Recommendations For versions up to, and including, 1.3.13, update to a version that includes a fix for the missing capability check in the reset customizer options() function. As a temporary workaround, consider restricting access to the reset customizer options() function to prevent unauthorized modification of the theme's settings.