PT-2025-10060 · WordPress · The Golo - City Travel Guide Wordpress Theme

Lucio Sá · Published 2025-03-07 · Updated 2025-03-08 · CVE-2024-12876

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Golo - City Travel Guide WordPress Theme versions up to, and including, 1.6.10

Description The issue allows for privilege escalation via account takeover due to improper validation of a user's identity prior to updating their password. This enables unauthenticated attackers to change arbitrary users' passwords, including administrators, and gain access to their accounts.

Recommendations For versions up to, and including, 1.6.10, update to a version that properly validates user identity before allowing password updates. As a temporary workaround, consider restricting access to password update functionality to prevent unauthorized changes.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-12876

Affected Products

The Golo - City Travel Guide Wordpress Theme

References · 12

• https://osv.dev/vulnerability/CVE-2024-12876 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12876 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e6cb81e5-61a4-4b67-a668-d8a7d46b2cea?source=cve · Note
• https://themeforest.net/item/golo-directory-listing-travel-wordpress-theme/25397810 · Note
• https://twitter.com/WolfgangSesin/status/1897998336671494501 · Twitter Post
• https://twitter.com/CVEnew/status/1898246391891214353 · Twitter Post
• https://twitter.com/vulns_space/status/1897953091204350276 · Twitter Post
• https://twitter.com/CveFindCom/status/1897928193358602334 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1898037921539580302 · Twitter Post
• https://t.me/cvedetector/19820 · Telegram Post
• https://twitter.com/cybercronai/status/1898003356544647213 · Twitter Post
• https://t.me/cvetracker/18650 · Telegram Post