CVE-2024-12263: CWE-862 Missing Authorization in lordspace Child Theme Creator by Orbisius
The Child Theme Creator by Orbisius plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cloud_delete() and cloud_update() functions in all versions up to, and including, 1.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and delete cloud snippets. Please note that this vulnerability was present in the Cloud Library Addon used by the plugin and not in the plugin itself, the cloud library has been removed entirely.
AI Analysis
Technical Summary
CVE-2024-12263 describes a missing authorization vulnerability in the Child Theme Creator by Orbisius WordPress plugin's Cloud Library Addon. The cloud_delete() and cloud_update() functions lack proper capability checks, enabling authenticated users with low privileges (Subscriber and above) to update or delete cloud snippets. This vulnerability affects all versions up to and including 1.5.5. The Cloud Library Addon has since been removed from the plugin, mitigating the risk by eliminating the vulnerable component. No known exploits are reported in the wild, and the CVSS 3.1 base score is 4.3 (medium severity).
Potential Impact
Authenticated users with Subscriber-level access or higher can modify or delete cloud snippets without authorization. There is no impact on confidentiality or availability, only limited integrity impact on cloud snippet data. The vulnerability is confined to the Cloud Library Addon, which has been removed, reducing the risk for current users.
Mitigation Recommendations
Since the vulnerability exists in the Cloud Library Addon and not the main plugin, and the addon has been removed entirely, users should ensure they are using versions of the plugin without the Cloud Library Addon. There is no official patch available. Users should verify that the Cloud Library Addon is not installed or active to mitigate this issue. Patch status is not yet confirmed; check the vendor advisory for any updates.
CVE-2024-12263: CWE-862 Missing Authorization in lordspace Child Theme Creator by Orbisius
Description
The Child Theme Creator by Orbisius plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cloud_delete() and cloud_update() functions in all versions up to, and including, 1.5.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update and delete cloud snippets. Please note that this vulnerability was present in the Cloud Library Addon used by the plugin and not in the plugin itself, the cloud library has been removed entirely.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-12263 describes a missing authorization vulnerability in the Child Theme Creator by Orbisius WordPress plugin's Cloud Library Addon. The cloud_delete() and cloud_update() functions lack proper capability checks, enabling authenticated users with low privileges (Subscriber and above) to update or delete cloud snippets. This vulnerability affects all versions up to and including 1.5.5. The Cloud Library Addon has since been removed from the plugin, mitigating the risk by eliminating the vulnerable component. No known exploits are reported in the wild, and the CVSS 3.1 base score is 4.3 (medium severity).
Potential Impact
Authenticated users with Subscriber-level access or higher can modify or delete cloud snippets without authorization. There is no impact on confidentiality or availability, only limited integrity impact on cloud snippet data. The vulnerability is confined to the Cloud Library Addon, which has been removed, reducing the risk for current users.
Mitigation Recommendations
Since the vulnerability exists in the Cloud Library Addon and not the main plugin, and the addon has been removed entirely, users should ensure they are using versions of the plugin without the Cloud Library Addon. There is no official patch available. Users should verify that the Cloud Library Addon is not installed or active to mitigate this issue. Patch status is not yet confirmed; check the vendor advisory for any updates.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-12-05T16:41:59.433Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6e33b7ef31ef0b597af9
Added to database: 2/25/2026, 9:48:35 PM
Last enriched: 4/9/2026, 6:17:04 AM
Last updated: 4/11/2026, 5:52:55 PM
Views: 24
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.