The Sala - Startup & SaaS WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.4. This is due to the theme not properly validating a user's identity prior to updating their details like password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
The theme does not properly verify user identity before executing account data update operations, including password changes. An attacker without any authentication can send a password change request for any user — including the administrator — without needing to know the current password. After changing the password, the attacker can log in to the compromised account and gain full access to the WordPress panel.
An attacker can take control of any user account, including the administrator account, resulting in complete compromise of the WordPress site — enables malware installation, data theft, and further attacks on the infrastructure.
The theme should be updated to a version newer than 1.1.4 as soon as possible. Until the patch is applied, it is recommended to consider temporarily disabling the theme or restricting access to the website. Patches available from the vendor should be applied according to the references.
WordPress theme 'Sala - Startup & SaaS WordPress Theme' in all versions up to and including 1.1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H