Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

The Total theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the total_order_sections() function in all versions up to, and including, 2.1.5...

CVE-2024-1771 · published 2 years ago
Summary

The Total theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the total_order_sections() function in all versions up to, and including, 2.1.59. This makes it possible for authenticated attackers, with subscriber-level access and above, to repea...

What to do
  • Update hashthemes total to version 2.1.60 or later.
Affected software
VendorProductAffected versions
hashthemes total < 2.1.60
cpe:2.3:a:hashthemes:total:*:*:*:*:*:wordpress:*:*
Original advisory text
The Total theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the total_order_sections() function in all versions up to, and including, 2.1.5...
The Total theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the total_order_sections() function in all versions up to, and including, 2.1.59. This makes it possible for authenticated attackers, with subscriber-level access and above, to repeat sections on the homepage.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published6 Mar 2024
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2024-1771 · NVD
Track software like this
Free during beta