{"schemaVersion":3,"id":"CVE-2024-1047","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.","dates":{"published":"2024-02-02T05:33:14.536Z","modified":"2026-04-08T16:56:47.195Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00555,"percentile":0.452,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00555},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00555,"percentile":0.452}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00555,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00555,"percentile":0.452}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/862.html"}],"affected":[{"vendor":"optimole","product":"optimole – optimize images in real time","name":"Optimole – Optimize Images in Real Time","label":"optimole – optimize images in real time","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 3.12.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 3.12.4","eol":null,"hubHref":"/vendor/optimole/optimole_-_optimize_images_in_real_time"},{"vendor":"optimole","product":"super_page_cache","name":"super page cache","label":"super_page_cache","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 4.7.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 4.7.5","eol":null,"hubHref":"/vendor/optimole/super_page_cache"},{"vendor":"rsocial","product":"revive social – social media auto post and scheduling automation plugin","name":"Revive Social – Social Media Auto Post and Scheduling Automation Plugin","label":"revive social – social media auto post and scheduling automation plugin","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 9.0.25","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 9.0.25","eol":null,"hubHref":"/vendor/rsocial/revive_social_-_social_media_auto_post_and_scheduling_automation_plugin"},{"vendor":"themeisle","product":"lightstart – maintenance mode, coming soon and landing page builder","name":"LightStart – Maintenance Mode, Coming Soon and Landing Page Builder","label":"lightstart – maintenance mode, coming soon and landing page builder","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.6.9","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.6.9","eol":null,"hubHref":"/vendor/themeisle/lightstart_-_maintenance_mode_coming_soon_and_landing_page_builder"},{"vendor":"themeisle","product":"menu icons by themeisle","name":"Menu Icons by ThemeIsle","label":"menu icons by themeisle","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 0.13.8","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 0.13.8","eol":null,"hubHref":"/vendor/themeisle/menu_icons_by_themeisle"},{"vendor":"themeisle","product":"multiple page generator plugin – mpg","name":"Multiple Page Generator Plugin – MPG","label":"multiple page generator plugin – mpg","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 3.4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 3.4.0","eol":null,"hubHref":"/vendor/themeisle/multiple_page_generator_plugin_-_mpg"},{"vendor":"themeisle","product":"orbit_fox","name":"orbit fox","label":"orbit_fox","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.10.28","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.10.28","eol":null,"hubHref":"/vendor/themeisle/orbit_fox"},{"vendor":"themeisle","product":"orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","label":"orbit fox: duplicate page, menu icons, svg support, cookie notice, custom fonts & more","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.10.28","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.10.28","eol":null,"hubHref":null},{"vendor":"themeisle","product":"otter blocks – gutenberg blocks, page builder for gutenberg editor & fse","name":"Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","label":"otter blocks – gutenberg blocks, page builder for gutenberg editor & fse","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.6.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.6.2","eol":null,"hubHref":"/vendor/themeisle/otter_blocks_-_gutenberg_blocks_page_builder_for_gutenberg_editor__fse"},{"vendor":"themeisle","product":"ppom – product addons & custom fields for woocommerce","name":"PPOM – Product Addons & Custom Fields for WooCommerce","label":"ppom – product addons & custom fields for woocommerce","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 32.0.9","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 32.0.9","eol":null,"hubHref":"/vendor/themeisle/ppom_-_product_addons__custom_fields_for_woocommerce"},{"vendor":"themeisle","product":"rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregator","name":"RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","label":"rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregator","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 4.4.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 4.4.1","eol":null,"hubHref":"/vendor/themeisle/rss_aggregator_by_feedzy_-_feed_to_post_autoblogging_news__youtube_video_feeds_aggregator"},{"vendor":"themeisle","product":"starter sites & templates by neve","name":"Starter Sites & Templates by Neve","label":"starter sites & templates by neve","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.2.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.2.6","eol":null,"hubHref":"/vendor/themeisle/starter_sites__templates_by_neve"},{"vendor":"themeisle","product":"visualizer: tables and charts manager for wordpress","name":"Visualizer: Tables and Charts Manager for WordPress","label":"visualizer: tables and charts manager for wordpress","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 3.10.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 3.10.6","eol":null,"hubHref":null},{"vendor":"wordpress","product":"feedzy-rss-feeds","name":"RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator","label":"feedzy-rss-feeds","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 4.4.1 (fixed in 4.4.2)","noFixRecorded":false,"fixedIn":"4.4.2"}],"versionsText":"≤ 4.4.1 (fixed in 4.4.2)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"menu-icons","name":"Menu Icons by Themeisle – Add Icons to Navigation Menus","label":"menu-icons","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 0.13.8 (fixed in 0.13.9)","noFixRecorded":false,"fixedIn":"0.13.9"}],"versionsText":"≤ 0.13.8 (fixed in 0.13.9)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"multiple-pages-generator-by-porthas","name":"MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO","label":"multiple-pages-generator-by-porthas","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 3.4.0 (fixed in 3.4.1)","noFixRecorded":false,"fixedIn":"3.4.1"}],"versionsText":"≤ 3.4.0 (fixed in 3.4.1)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"optimole-wp","name":"Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization","label":"optimole-wp","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 3.12.4 (fixed in 3.12.5)","noFixRecorded":false,"fixedIn":"3.12.5"}],"versionsText":"≤ 3.12.4 (fixed in 3.12.5)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"otter-blocks","name":"Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE","label":"otter-blocks","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.6.2 (fixed in 2.6.3)","noFixRecorded":false,"fixedIn":"2.6.3"}],"versionsText":"≤ 2.6.2 (fixed in 2.6.3)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"templates-patterns-collection","name":"Starter Sites & Templates by Neve","label":"templates-patterns-collection","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.2.6 (fixed in 1.2.7)","noFixRecorded":false,"fixedIn":"1.2.7"}],"versionsText":"≤ 1.2.6 (fixed in 1.2.7)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"themeisle-companion","name":"Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More","label":"themeisle-companion","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.10.28 (fixed in 2.10.29)","noFixRecorded":false,"fixedIn":"2.10.29"}],"versionsText":"≤ 2.10.28 (fixed in 2.10.29)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"tweet-old-post","name":"Revive Social – Social Media Auto Post and Scheduling Automation Plugin","label":"tweet-old-post","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 9.0.25 (fixed in 9.0.26)","noFixRecorded":false,"fixedIn":"9.0.26"}],"versionsText":"≤ 9.0.25 (fixed in 9.0.26)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"visualizer","name":"Visualizer – Tables & Charts Manager with Built-in AI Generator","label":"visualizer","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 3.10.6 (fixed in 3.10.7)","noFixRecorded":false,"fixedIn":"3.10.7"}],"versionsText":"≤ 3.10.6 (fixed in 3.10.7)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"woocommerce-product-addon","name":"PPOM – Product Addons & Custom Fields for WooCommerce","label":"woocommerce-product-addon","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 32.0.9 (fixed in 32.0.10)","noFixRecorded":false,"fixedIn":"32.0.10"}],"versionsText":"≤ 32.0.9 (fixed in 32.0.10)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"wp-cloudflare-page-cache","name":"Super Page Cache – Cloudflare Cache, Page Speed & Core Web Vitals","label":"wp-cloudflare-page-cache","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 4.7.5 (fixed in 4.7.6)","noFixRecorded":false,"fixedIn":"4.7.6"}],"versionsText":"≤ 4.7.5 (fixed in 4.7.6)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"wp-maintenance-mode","name":"LightStart – Maintenance Mode, Coming Soon and Landing Page Builder","label":"wp-maintenance-mode","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.6.9 (fixed in 2.6.10)","noFixRecorded":false,"fixedIn":"2.6.10"}],"versionsText":"≤ 2.6.9 (fixed in 2.6.10)","eol":null,"hubHref":null}],"affectedCount":25,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6147582f-578a-47ad-b16c-65c37896783d?source=cve","label":"www.wordfence.com/threat-intel/vulnerabilities/id/6147582f-578a-47ad-b16c-65c37896783d?source=cve","hostname":"www.wordfence.com","tags":["Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/browser/themeisle-companion/trunk/vendor/codeinwp/themeisle-sdk/src/Modules/Promotions.php#L175","label":"plugins.trac.wordpress.org/browser/…","hostname":"plugins.trac.wordpress.org","tags":["Patch"]},{"url":"https://plugins.trac.wordpress.org/changeset/3029507/themeisle-companion/tags/2.10.29/vendor/codeinwp/themeisle-sdk/src/Modules/Promotions.php","label":"plugins.trac.wordpress.org/changeset/…","hostname":"plugins.trac.wordpress.org","tags":["Patch"]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3040302%40templates-patterns-collection&new=3040302%40templates-patterns-collection&sfp_email=&sfph_mail=","label":"plugins.trac.wordpress.org/changeset","hostname":"plugins.trac.wordpress.org","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6147582f-578a-47ad-b16c-65c37896783d","label":"www.wordfence.com/threat-intel/vulnerabilities/id/6147582f-578a-47ad-b16c-65c37896783d","hostname":"www.wordfence.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2024-02-02T05:33:14.536Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-08T16:56:47.195Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":21,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T22:42:56.753Z","stale":false,"partial":false}}