Vw Writer Blog
Monthly
Authenticated attackers with Subscriber-level or higher access on WordPress sites running the VW Writer Blog theme (versions up to and including 1.3.8) can reset all theme customizer settings to their defaults because the 'vw_writer_blog_reset_all_settings' function lacks a capability check. This integrity-only issue has low impact-no data disclosure, code execution, or site downtime-and requires a valid low-privilege account; sites with registration disabled are less exposed. No public exploit or active exploitation is identified at time of analysis.
Authenticated attackers with Subscriber-level or higher access on WordPress sites running the VW Writer Blog theme (versions up to and including 1.3.8) can reset all theme customizer settings to their defaults because the 'vw_writer_blog_reset_all_settings' function lacks a capability check. This integrity-only issue has low impact-no data disclosure, code execution, or site downtime-and requires a valid low-privilege account; sites with registration disabled are less exposed. No public exploit or active exploitation is identified at time of analysis.