The ZoxPress WordPress theme contains a missing authorization vulnerability (CWE-862) in its 'backup_options' and 'restore_options' functions. Authenticated users with low privileges (Subscriber-level and above) can exploit this flaw to update arbitrary WordPress options, including those controlling user roles and registration settings. This can be leveraged to escalate privileges by setting the default registration role to administrator and enabling user registration, allowing attackers to create administrative accounts on the affected site. The vulnerability affects all versions up to and including 2.12.0 and has a CVSS 3.1 base score of 8.8, indicating high severity.

Successful exploitation allows an authenticated low-privilege user to escalate their privileges to administrator by modifying critical WordPress options. This compromises the confidentiality, integrity, and availability of the affected WordPress site, as attackers can gain full administrative control, potentially leading to site takeover, data manipulation, and further malicious activities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user access and disable user registration if not required to reduce exposure. Monitor for updates from MVPThemes regarding a security patch for this vulnerability.