CVE-2024-13376 is a high-severity vulnerability in the Industrial WordPress theme by Anps, affecting all versions up to and including 1.7.8. The issue stems from improper privilege management (CWE-269) due to a missing capability check in the _ajax_get_total_content_import_items() function. Authenticated users with subscriber-level privileges or higher can exploit this flaw to update arbitrary WordPress options, including setting the default registration role to administrator and enabling user registration. This leads to privilege escalation, allowing attackers to gain administrative control over the affected WordPress site.

Successful exploitation allows an authenticated low-privilege user to escalate their privileges to administrator by modifying critical WordPress options. This compromises the confidentiality, integrity, and availability of the affected site, as attackers can fully control site content, settings, and user accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user roles to trusted users only and consider disabling user registration if not required. Monitor for updates from Anps regarding patches or official mitigations.