Th Shop Mania
Monthly
Missing authorization in the ThemeHunk Th Shop Mania WordPress theme (versions through 1.9.1) lets an authenticated low-privilege user invoke theme functionality that lacks a proper capability check, primarily degrading site availability and allowing limited unauthorized changes. Exploitation is remote, requires only a valid low-privileged WordPress account on a site where the theme is installed and active, and needs no user interaction; no public exploit has been identified at time of analysis. The CVSS 3.1 base score is 7.1, driven almost entirely by the high availability impact (A:H) rather than confidentiality (C:N) or broad integrity loss (I:L).
Missing authorization in the ThemeHunk Th Shop Mania WordPress theme (versions through 1.9.1) lets an authenticated low-privilege user invoke theme functionality that lacks a proper capability check, primarily degrading site availability and allowing limited unauthorized changes. Exploitation is remote, requires only a valid low-privileged WordPress account on a site where the theme is installed and active, and needs no user interaction; no public exploit has been identified at time of analysis. The CVSS 3.1 base score is 7.1, driven almost entirely by the high availability impact (A:H) rather than confidentiality (C:N) or broad integrity loss (I:L).