CVE-2024-13686: 
WordPress vulnerability analysis and mitigation

The VW Storefront theme for WordPress contains a vulnerability (CVE-2024-13686) related to unauthorized modification of data due to a missing capability check on the vw_storefront_reset_all_settings() function. This vulnerability affects all versions up to and including 0.9.9, and was discovered in March 2025. The issue allows authenticated attackers with Subscriber-level access or higher to reset the theme's settings (NVD).

The vulnerability stems from a missing authorization check in the vw_storefront_reset_all_settings() function. It has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The weakness is categorized as CWE-862 (Missing Authorization) (NVD).

When exploited, this vulnerability allows authenticated users with Subscriber-level privileges or higher to reset all theme settings to their default values, potentially disrupting the website's appearance and functionality (NVD).

The vulnerability has been patched in version 1.0.0 of the VW Storefront theme. Users are advised to update to this version or later to protect against unauthorized theme settings modifications (WordPress Themes).