CVE-2024-13423 describes a missing authorization vulnerability in the Sparkling WordPress theme by silkalns. Specifically, the 'sparkling_activate_plugin' and 'sparkling_deactivate_plugin' functions lack capability checks, enabling unauthenticated attackers to activate or deactivate plugins arbitrarily. This issue affects versions up to and including 2.4.9. The vulnerability is classified under CWE-862 and has a CVSS 3.1 base score of 5.3, indicating a medium impact primarily on integrity. No known exploits are reported in the wild, and no patch or remediation guidance has been provided by the vendor.

An attacker without authentication can activate or deactivate plugins on a WordPress site using the vulnerable Sparkling theme, potentially altering site functionality or security posture. The impact is limited to integrity as no confidentiality or availability impacts are indicated. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, site administrators should consider disabling or replacing the Sparkling theme or restricting access to plugin management through other means. Monitor official vendor channels for updates regarding patches or official fixes.