CVE-2024-13811 describes a missing authorization vulnerability in the Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme for WordPress. Specifically, the AJAX action 'lafka_import_lafka' lacks proper capability checks, allowing authenticated users with low privileges (Subscriber-level and above) to import demo data that overrides existing site content. This vulnerability affects all versions up to and including 4.5.7. The CVSS 3.1 score is 4.3, reflecting a medium severity impact primarily on integrity. No patch or remediation guidance is currently provided by the vendor or in the advisory.

An attacker with authenticated access at Subscriber level or higher can exploit this vulnerability to import demo data that overrides the site's existing content. This impacts the integrity of the website by allowing unauthorized modification of site data. There is no direct impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for unauthorized changes. Avoid granting unnecessary authenticated access to untrusted users. Review and harden AJAX action permissions if possible.