CVE-2024-12296 Apus Framework <= 2.4 - Authenticated (Subscriber+) Arbitrary Options Update in import_page_options

What is CVE-2024-12296?

CVE-2024-12296 is a high-severity missing authorization vulnerability in ApusTheme Apus Framework, published on 12 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Apus Framework plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'import_page_options' function in all versions up to, and including, 2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. NOTE: This vulnerability was partially fixed in version 2.4.

Weakness: CWE-862

Which versions are affected by CVE-2024-12296?

It affects 1 product.

Products include Apusthemes Superio.

How do I fix CVE-2024-12296?

No fix has been published for CVE-2024-12296 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-12296 being exploited?

There is no known exploitation of CVE-2024-12296 in the wild and no public exploit code.

Other vulnerabilities in ApusTheme Apus Framework

• CVE-2024-12213 WP Job Board Pro < 1.2.85 - Unauthenticated Privilege Escalation via process_register Critical 9.8
• CVE-2022-4114 Superio - Job Board < 1.2.33 - Subscriber+ Stored Cross-Site Scripting Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4vxh-jq3c-5rhw.