The Click Mag WordPress theme suffers from a missing capability check in the propanel_of_ajax_callback() function, enabling authenticated attackers with low privileges (subscriber and above) to delete arbitrary options on the WordPress site. This unauthorized deletion can trigger site errors resulting in denial of service. The vulnerability is present in all versions up to and including 3.6.0. The CVSS 3.1 score is 8.1, reflecting network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts.

An attacker with subscriber-level access can delete arbitrary option values, potentially causing site errors and denial of service to legitimate users. The integrity and availability of the affected WordPress site are compromised. There is no direct confidentiality impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access carefully and monitor for suspicious activity related to option deletions. Avoid granting unnecessary privileges to low-level users. Follow updates from MVPThemes or WordPress security channels for patches.