CVE-2024-1047 ThemeIsle SDK <= Various Versions - Missing Authorization
Unauthenticated attackers can modify promotional tracking options in multiple WordPress plugins using the ThemeIsle SDK due to missing capability checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-1047?
CVE-2024-1047 is a medium-severity missing authorization vulnerability in optimole LightStart – Maintenance Mode, Coming Soon and Landing Page Builder, published on 2 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.
Weakness: CWE-862
Which versions are affected by CVE-2024-1047?
It affects 1 product.
Products include Themeisle Orbit Fox.
How do I fix CVE-2024-1047?
No fix has been published for CVE-2024-1047 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-1047 being exploited?
There is no known exploitation of CVE-2024-1047 in the wild and no public exploit code.
Other vulnerabilities in optimole LightStart – Maintenance Mode, Coming Soon and Landing Page Builder
- CVE-2025-22659 WordPress Orbit Fox by ThemeIsle plugin <= 2.10.44 - Cross Site Scripting (XSS) vulnerability
- CVE-2021-24158 Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Escalation
- CVE-2024-13183 Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter
- CVE-2025-0311 Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget
- CVE-2024-7778 Orbit Fox by ThemeIsle <= 2.10.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Sources
Also known as GHSA-f527-jggh-c37w.