CVE-2024-12920: 
WordPress vulnerability analysis and mitigation

The FoodBakery WordPress Theme contains a critical vulnerability (CVE-2024-12920) discovered in versions up to and including 4.7. The vulnerability stems from missing capability checks on multiple functions including foodbakery_var_backup_file_delete, foodbakery_widget_file_delete, theme_option_save, and others. This security flaw was disclosed on March 19, 2025 (NVD).

The vulnerability is caused by missing authorization checks on several critical functions: foodbakery_var_backup_file_delete, foodbakery_widget_file_delete, theme_option_save, export_widget_settings, ajax_import_widget_data, foodbakery_var_settings_backup_generate, foodbakery_var_backup_file_restore, and theme_option_rest_all. The vulnerability has been assigned a CVSS v3.1 score of 8.8 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Wordfence).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to perform unauthorized actions including: deleting arbitrary files, updating theme options, exporting widget options, importing widget options, generating backups, restoring backups, and resetting theme options (NVD).

The vulnerability can be exploited by any authenticated user with Subscriber-level privileges or higher. The attack requires low complexity and no user interaction, making it relatively straightforward to exploit (Wordfence).

Users should upgrade to a version newer than 4.7 when available. As this is a recently disclosed vulnerability, users should monitor the theme developer's website and WordPress repository for security updates (ThemeForest).