Security readout for executives and security teams
Plain-English summary
CVE-2024-1388 affects the Yuki WordPress theme through version 1.3.13. A logged-in user with subscriber-level access or higher could reset the theme’s Customizer settings. This is mainly an integrity and operational issue: it could disrupt site appearance or configuration, but the cited sources do not show data theft, code execution, or full site takeover.
Executive priority
Treat this as a near-term hygiene fix, not an emergency unless the site allows broad user registration. The business risk is visible site disruption or unwanted configuration rollback, which can affect trust and operations but is not described as a compromise path in the sources.
Technical view
The issue is a missing authorization check in Yuki’s reset_customizer_options() function, mapped to CWE-862. The CVSS 3.1 score is 4.3: network-reachable, low complexity, low privileges required, no user interaction, and low integrity impact only. The source bundle identifies versions up to and including 1.3.13 as vulnerable.
Likely exposure
Exposure is limited to WordPress sites using the Yuki theme at version 1.3.13 or earlier, where untrusted or numerous authenticated users exist. Sites with open registration or many subscriber accounts have higher practical risk.
Exploitation context
The CVE is not listed in KEV, and the provided sources do not claim active exploitation. Abuse requires an authenticated account with subscriber-level access or above. The documented outcome is resetting theme settings, not privilege escalation or server compromise.
Researcher notes
Evidence supports missing authorization around reset_customizer_options() in the Yuki theme. The cited impact is unauthorized reset of theme settings by authenticated subscriber-plus users. No provided source supports exploit-in-the-wild status, data exposure, remote code execution, or a broader WordPress core issue.
Mitigation direction
- Update Yuki to a vendor-fixed release newer than 1.3.13.
- Check the WordPress theme repository and vendor guidance for current fixed versions.
- Limit subscriber accounts to trusted users where possible.
- Disable open registration if it is not operationally required.
- Back up theme Customizer settings before remediation where feasible.
Validation and detection
- Inventory WordPress sites using the Yuki theme.
- Confirm each Yuki installation is newer than 1.3.13.
- Review whether public registration or untrusted subscribers are enabled.
- Check recent site logs or admin history for unexplained theme setting resets.
- Verify role assignments for subscriber-level and higher users.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-1388 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.