vulnerability
WordPress Theme: houzez: CVE-2024-22303: Incorrect Privilege Assignment
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 9 | (AV:N/AC:L/Au:S/C:C/I:C/A:C) | Sep 17, 2024 | Dec 8, 2025 | Dec 8, 2025 |
Severity
9
CVSS
(AV:N/AC:L/Au:S/C:C/I:C/A:C)
Published
Sep 17, 2024
Added
Dec 8, 2025
Modified
Dec 8, 2025
Description
The Houzez theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the houzez_ajax_password_reset function not properly verifying a user's identity prior to reseting a password. This makes it possible for authenticated attackers, with subscriber-level access and above, to gain administrative access to vulnerable sites.
Solution
houzez-theme-cve-2024-22303
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.