The ColorMag WordPress theme contains a missing capability check in the plugin_action_callback() function in all versions up to 3.1.2. This lack of authorization verification enables authenticated users with subscriber-level permissions or above to install and activate arbitrary plugins, potentially escalating their privileges or altering site functionality. The vulnerability is tracked as CVE-2024-0679 and is classified under CWE-862 (Missing Authorization). It has a CVSS v3.1 base score of 6.5, indicating a medium severity level. No known exploits in the wild have been reported, and no official patch or vendor advisory is currently provided.

An attacker with subscriber-level access or higher can exploit this vulnerability to install and activate arbitrary plugins on a vulnerable WordPress site using the ColorMag theme. This could lead to privilege escalation or unauthorized changes to the site’s functionality. There is no direct confidentiality or availability impact reported, but integrity is impacted due to unauthorized plugin activation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access where possible and monitor for suspicious plugin installations. Avoid granting unnecessary permissions to low-privilege users. Follow updates from the themegrill vendor for an official patch or temporary mitigation.