CVE-2024-13769 is a stored cross-site scripting vulnerability in the ThemeREX Puzzles | WP Magazine / Review with Store WordPress Theme + RTL. The issue arises from a missing capability check on the 'theme_options_ajax_post_action' AJAX endpoint, allowing authenticated users with low privileges (Subscriber and above) to modify theme settings and inject malicious scripts. This vulnerability affects all versions up to and including 4.2.4. The developer has discontinued the theme and removed it from the repository, so no official patch or update exists.

Exploitation allows authenticated users with Subscriber-level privileges or higher to inject persistent malicious scripts into the theme settings, potentially leading to cross-site scripting attacks affecting site visitors or administrators. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Since the developer has removed the theme from the repository and no patch or update is available, the recommended mitigation is to discontinue use of the affected theme and replace it with a secure alternative. No official fix exists, so continued use of this theme poses a security risk.