{"id":"CVE-2024-13420","aliases":["EUVD-2024-54449","GHSA-98r7-98px-p4mx"],"status":"published","title":"Smart Framework \u003c= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Settings Updates","description":"Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_section_options', 'gsf_reset_section_options', 'gsf_create_preset_options' and more in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset and modify some of the plugin/theme settings. This issue was escalated to Envato over two months from the date of this disclosure and the issues, while partially patched, are still vulnerable.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00242,"percentile":0.155,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862","CWE-94"],"published":"2025-05-02T03:21:19Z","modified":"2026-06-17T07:01:58Z","products":[{"vendor":"g5plus","product":"april"},{"vendor":"g5plus","product":"auteur"},{"vendor":"g5plus","product":"benaa"},{"vendor":"g5plus","product":"beyot"},{"vendor":"g5theme","product":"april framework"},{"vendor":"g5theme","product":"auteur framework"},{"vendor":"g5theme","product":"benaa framework"},{"vendor":"g5theme","product":"beyot framework"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6d484422-4adf-4370-b228-61496d5ad78a?source=cve","tags":["Third Party Advisory"]},{"url":"https://themeforest.net/item/beyot-wordpress-real-estate-theme/19514964","tags":["Product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13420"},{"url":"https://github.com/advisories/GHSA-98r7-98px-p4mx"}],"sources":{"cve":[{"id":"CVE-2024-13420","title":"Smart Framework \u003c= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Settings Updates","description":"Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_section_options', 'gsf_reset_section_options', 'gsf_create_preset_options' and more in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset and modify some of the plugin/theme settings. This issue was escalated to Envato over two months from the date of this disclosure and the issues, while partially patched, are still vulnerable.","status":"published","published":"2025-05-02T03:21:19.589Z","modified":"2026-04-08T16:59:24.041Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:13.64024Z"}],"euvd":[{"id":"EUVD-2024-54449","description":"Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_section_options', 'gsf_reset_section_options', 'gsf_create_preset_options' and more in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset and modify some of the plugin/theme settings. This issue was escalated to Envato over two months from the date of this disclosure and the issues, while partially patched, are still vulnerable.","status":"published","published":"2025-05-02T03:21:19Z","modified":"2026-04-08T16:59:24Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:54.685702Z"}],"ghsa":[{"id":"GHSA-98r7-98px-p4mx","title":"Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a...","description":"Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_section_options', 'gsf_reset_section_options', 'gsf_create_preset_options' and more in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset and modify some of the plugin/theme settings. This issue was escalated to Envato over two months from the date of this disclosure and the issues, while partially patched, are still vulnerable.","status":"published","published":"2025-05-02T06:31:24Z","modified":"2025-05-06T15:30:58Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-94","CWE-862"],"updated_at":"2026-11-02T15:02:08.502889Z"}],"nvd":[{"id":"CVE-2024-13420","description":"Multiple plugins and/or themes for WordPress are vulnerable to unauthorized access due to a missing capability check on several AJAX actions like 'gsf_reset_section_options', 'gsf_reset_section_options', 'gsf_create_preset_options' and more in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset and modify some of the plugin/theme settings. This issue was escalated to Envato over two months from the date of this disclosure and the issues, while partially patched, are still vulnerable.","status":"published","published":"2025-05-02T04:15:46.047Z","modified":"2026-06-17T07:01:58.72Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-94","CWE-862"],"updated_at":"2026-11-02T14:10:46.40251Z"}]}}