IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
5.3Medium

CVE-2024-1047ThemeIsle SDK <= Various Versions - Missing Authorization

themeisle Menu Icons by ThemeIsle; themeisle Starter Sites & Templates by Neve; themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & … Published: (2 years ago)

Description

Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.

Weakness (CWE): CWE-862

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
optimole Optimole – Optimize Images in Real Time ≤ 3.12.4
optimole Super Page Cache ≤ 4.7.5
rsocial Revive Social – Social Media Auto Post and Scheduling Automation Plugin ≤ 9.0.25
themeisle LightStart – Maintenance Mode, Coming Soon and Landing Page Builder ≤ 2.6.9
themeisle Menu Icons by ThemeIsle ≤ 0.13.8
themeisle Multiple Page Generator Plugin – MPG ≤ 3.4.0
themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More ≤ 2.10.28
themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE ≤ 2.6.2
themeisle PPOM – Product Addons & Custom Fields for WooCommerce ≤ 32.0.9
themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator ≤ 4.4.1
themeisle Starter Sites & Templates by Neve ≤ 1.2.6
themeisle Visualizer: Tables and Charts Manager for WordPress ≤ 3.10.6

References and patches

Recent CVEs in the same product — WordPress plugins & themes

7.1High
CVE-2026-124969

Optimole <= 4.2.19 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via 'comment_content'/'comment_agent' Parameter during Attachment Rename

optimole Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the replace_urls_in_value function in all versions up to, and…

9.8Critical
CVE-2026-126173

AutomatorWP Pro Webhooks addon <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary User Password Reset / Account Takeover via Webhook with 'Is the user ID' Field

AutomatorWP AutomatorWP Webhooks

The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible …