CVE-2024-13423: Sparkling <= 2.4.9 - Missing Authorization to Unauthenticated Arbitrary Plugin Activation/Deactivation

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-05 · updated 2026-06-17
Weakness: CWE-862

Description

The Sparkling theme for WordPress is vulnerable to unauthorized plugin activation/deactivation due to a missing capability check on the 'sparkling_activate_plugin' and 'sparkling_deactivate_plugin' functions in versions up to, and including, 2.4.9. This makes it possible for unauthenticated attackers to activate/deactivate arbitrary plugins.

Affected products

silkalns Sparkling: through 2.4.9

References

https://themes.trac.wordpress.org/browser/sparkling/2.4.9/inc/welcome-screen/class-sparkling-welcome.php#L69
https://themes.trac.wordpress.org/browser/sparkling/2.4.9/inc/welcome-screen/class-sparkling-welcome.php#L82
https://themes.trac.wordpress.org/changeset/266657/#file3
https://www.wordfence.com/threat-intel/vulnerabilities/id/1fa8dba0-0227-428d-a6de-c4247c40e481?source=cve

Get alerted when CVE-2024-13423 or the next vulnerability affects your stack