CVE-2024-2962 is a missing authorization vulnerability in the Networker - Tech News WordPress Theme with Dark Mode by codesupplyco. Specifically, the admin_reload_nav_menu() function lacks a capability check, enabling unauthenticated attackers to alter menu display locations. This affects all versions up to and including 1.1.9. The vulnerability is rated medium severity with a CVSS 3.1 score of 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and an impact limited to integrity loss. No patch or official fix has been disclosed by the vendor as of the publication date.

An unauthenticated attacker can modify the location of display menus on affected WordPress sites using the vulnerable theme, potentially disrupting site navigation and user experience. The impact is limited to integrity (modification of data) with no confidentiality or availability impact reported. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider disabling or replacing the vulnerable theme to prevent unauthorized menu modifications. Monitoring for updates from the vendor or theme developer is recommended.