CVE-2024-12876: Golo - Directory & Listing, Travel WordPress Theme <= 1.6.10 - Missing Authorization to Privilege Escalation via Unauthenticated Arbitrary User Password Change
First published: Fri Mar 07 2025(Updated: )
The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.10. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Golo City Travel Guide | <=1.6.10 | |
| WordPress | <1.6.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-12876?
CVE-2024-12876 has a medium severity level due to its potential for privilege escalation through account takeover.
How do I fix CVE-2024-12876?
To fix CVE-2024-12876, update the Golo - City Travel Guide WordPress Theme to version 1.6.11 or later.
What causes the vulnerability in CVE-2024-12876?
CVE-2024-12876 is caused by inadequate validation of a user's identity prior to allowing password updates.
Which versions are affected by CVE-2024-12876?
CVE-2024-12876 affects all versions of the Golo - City Travel Guide WordPress Theme up to and including version 1.6.10.
Who is affected by CVE-2024-12876?
Users of the Golo - City Travel Guide WordPress Theme prior to version 1.6.11 are at risk of account takeover due to CVE-2024-12876.
- agent/references
- agent/title
- agent/description
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/source
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/golo
- canonical/golo city travel guide
- vendor/uxper
- canonical/wordpress