CVE-2024-2476: 
WordPress vulnerability analysis and mitigation

The OceanWP WordPress theme contains a vulnerability (CVE-2024-2476) in versions up to and including 3.5.4 due to a missing capability check on the load_theme_panel_pane function. This vulnerability was discovered and disclosed in March 2024 (Wordfence, WPScan).

The vulnerability stems from a missing authorization check in the load_theme_panel_pane function, which allows authenticated users with subscriber-level access or higher to access sensitive information. The issue has been assigned a CVSS v3.1 score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (WPScan).

When exploited, this vulnerability allows authenticated attackers with subscriber-level privileges to expose sensitive system and environment data, including API keys (NVD).

The vulnerability requires an authenticated user with at least subscriber-level access to exploit. No public exploits have been reported in the wild at the time of assessment.

The vulnerability has been patched in OceanWP version 3.5.5. Users are strongly advised to update to this version to protect against potential exploitation (WordPress Themes).