CVE-2024-12810 is a missing authorization vulnerability in the JobCareer | Job Board Responsive WordPress Theme for WordPress, affecting all versions up to and including 7.1. The theme fails to enforce capability checks on multiple functions, enabling authenticated users with Subscriber-level privileges or higher to delete arbitrary files, generate and restore backups, update theme options, and reset theme options to default. This lack of proper authorization controls can lead to unauthorized modification and loss of data. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity. There is no vendor advisory or patch information provided, and the product is not a cloud service.

Exploitation of this vulnerability allows authenticated users with low-level privileges (Subscriber and above) to perform unauthorized actions that can compromise the confidentiality, integrity, and availability of the affected WordPress site. Specifically, attackers can delete arbitrary files, potentially causing data loss; generate and restore backups, which could be used to manipulate site data; and modify theme options, potentially altering site behavior or appearance. This could lead to site defacement, data corruption, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and consider disabling or limiting access to the affected theme's functions if possible. Monitor for updates from the theme vendor or WordPress security channels to apply any forthcoming patches promptly.