The Zox News - Professional WordPress News & Magazine Theme plugin suffers from a missing authorization vulnerability (CWE-862) in its backup_options() and reset_options() functions. This flaw allows authenticated users with low privileges (Subscriber and above) to update or delete arbitrary WordPress options. Attackers can escalate privileges by setting the default registration role to Administrator and enabling user registration, thereby gaining full administrative access. They can also disrupt site functionality by deleting essential options, causing denial of service. The vulnerability affects all versions up to and including 3.17.0. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is provided in the data.

An attacker with Subscriber-level access or higher can exploit this vulnerability to escalate privileges to Administrator by modifying site options related to user roles and registration. This leads to full administrative control over the WordPress site. Additionally, attackers can delete critical options, causing site errors and denial of service conditions, impacting availability and functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access and above to trusted users only. Monitor for suspicious changes to site options and consider disabling user registration if not required. Avoid granting unnecessary privileges to low-level users.