WordPress CVEs

Description

The Orchid Store theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'orchid_store_activate_plugin' function in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Addonify Floating Cart For WooCommerce plugin if it is installed.

Affected WordPress components

• Orchid Store Theme · orchid-store
  Confirmed match Active
  Up to and including 1.5.6
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• themebeez Orchid Store — Up to and including 1.5.6
• themebeez orchid_store — Before 1.5.7

References

• themes.trac.wordpress.org https://themes.trac.wordpress.org/browser/orchid-store/1.5.6/functions.php#L300 Product
• themes.trac.wordpress.org https://themes.trac.wordpress.org/changeset/237704/ Patch
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/5402f206-0375-4c47-8a5c-e8ea5742493d?source=cve Third Party Advisory
• nvd.nist.gov Official NVD record