vulnerability
WordPress Theme: swape: CVE-2018-21013: Missing Authorization
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:L/Au:N/C:P/I:P/A:P) | Feb 8, 2018 | Dec 8, 2025 | Dec 8, 2025 |
Severity
7
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
Feb 8, 2018
Added
Dec 8, 2025
Modified
Dec 8, 2025
Description
The "Swape - App Showcase and App Store WordPress Theme" theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'call_upper_load_settings' AJAX action in versions up to 1.2.1. This makes it possible for unauthenticated attackers to modify arbitrary site options which can be used to create new administrative user accounts and achieve privilege escalation.
Solution
swape-theme-cve-2018-21013
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.