{"id":"CVE-2024-1047","aliases":["EUVD-2024-16823","GHSA-f527-jggh-c37w"],"status":"published","title":"ThemeIsle SDK  \u003c= Various Versions - Missing Authorization","description":"Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00555,"percentile":0.46583,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2024-02-02T05:33:14Z","modified":"2026-06-17T07:03:19Z","products":[{"vendor":"optimole","product":"optimole – optimize images in real time"},{"vendor":"optimole","product":"super page cache"},{"vendor":"rsocial","product":"revive social – social media auto post and scheduling automation plugin"},{"vendor":"themeisle","product":"lightstart – maintenance mode, coming soon and landing page builder"},{"vendor":"themeisle","product":"menu icons by themeisle"},{"vendor":"themeisle","product":"multiple page generator plugin – mpg"},{"vendor":"themeisle","product":"orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts \u0026 more"},{"vendor":"themeisle","product":"orbit_fox"},{"vendor":"themeisle","product":"otter blocks – gutenberg blocks, page builder for gutenberg editor \u0026 fse"},{"vendor":"themeisle","product":"ppom – product addons \u0026 custom fields for woocommerce"},{"vendor":"themeisle","product":"rss aggregator by feedzy – feed to post, autoblogging, news \u0026 youtube video feeds aggregator"},{"vendor":"themeisle","product":"starter sites \u0026 templates by neve"},{"vendor":"themeisle","product":"visualizer: tables and charts manager for wordpress"},{"vendor":"unknown","product":"orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts \u0026 more"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6147582f-578a-47ad-b16c-65c37896783d?source=cve","tags":["x_transferred","Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/browser/themeisle-companion/trunk/vendor/codeinwp/themeisle-sdk/src/Modules/Promotions.php#L175","tags":["x_transferred","Patch"]},{"url":"https://plugins.trac.wordpress.org/changeset/3029507/themeisle-companion/tags/2.10.29/vendor/codeinwp/themeisle-sdk/src/Modules/Promotions.php","tags":["x_transferred","Patch"]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3040302%40templates-patterns-collection\u0026new=3040302%40templates-patterns-collection\u0026sfp_email=\u0026sfph_mail="},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1047"},{"url":"https://github.com/advisories/GHSA-f527-jggh-c37w"}],"sources":{"cve":[{"id":"CVE-2024-1047","title":"ThemeIsle SDK  \u003c= Various Versions - Missing Authorization","description":"Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.","status":"published","published":"2024-02-02T05:33:14.536Z","modified":"2026-04-08T16:56:47.195Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:34:17.865042Z"}],"euvd":[{"id":"EUVD-2024-16823","description":"Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.","status":"published","published":"2024-02-02T05:33:14Z","modified":"2026-04-08T16:56:47Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:56.607873Z"}],"ghsa":[{"id":"GHSA-f527-jggh-c37w","title":"The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to unauthorized modification of...","description":"The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in all versions up to, and including, 2.10.28. This makes it possible for unauthenticated attackers to update the connected API keys.","status":"published","published":"2024-02-02T06:30:32Z","modified":"2026-04-08T18:33:34Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:07:14.458027Z"}],"nvd":[{"id":"CVE-2024-1047","description":"Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.","status":"published","published":"2024-02-02T06:15:45.19Z","modified":"2026-06-17T07:03:19.26Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:09:34.891666Z"}]}}