CVE-2024-12876 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Account takeover vulnerability in Golo Theme. 💥 **Consequences**: Unauthenticated users can change **ANY** user's password. Full account compromise possible.

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-862 (Missing Authorization). 🔍 **Flaw**: The plugin fails to verify if the user requesting a password change is the owner of the account. No access control check.

Q: Who is affected? (Versions/Components)

📦 **Affected**: WordPress Plugin: **Golo - City Travel Guide WordPress Theme**. 📉 **Version**: **1.6.10** and earlier. 🏢 **Vendor**: uxper.

Q: What can hackers do? (Privileges/Data)

👮 **Hackers Can**: Reset passwords for **arbitrary users** (Admins, Editors, etc.). 🔓 **Privileges**: Gain full administrative access without needing initial login credentials.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. 🌐 **Auth**: **None required** (PR:N). 🖱️ **UI**: **None required** (UI:N). 📡 **Network**: Remote (AV:N). Easy to exploit.

Q: Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exp?**: No specific PoC code provided in data. 🌍 **Wild Exp**: Likely low volume currently, but high impact makes it attractive. Check WordFence Intel for active threats.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for **Golo Theme** version **1.6.10** or lower. 🧪 **Test**: Attempt password reset for a test account without being logged in. If it works, you are vulnerable.

Q: Is it fixed officially? (Patch/Mitigation)

🔧 **Fix**: Update to the latest version of **Golo - City Travel Guide WordPress Theme**. ✅ **Status**: Patch available from vendor (uxper) via ThemeForest/WordPress repo.

Q: What if no patch? (Workaround)

🚧 **No Patch?**: Disable the theme immediately. 🛑 **Mitigation**: Switch to a default WordPress theme temporarily. 🔒 **Access**: Monitor admin logs for suspicious password change activities.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. 📈 **Priority**: **P1**. CVSS Score is **High** (9.8 implied by H/I/H). ⏱️ **Action**: Patch **IMMEDIATELY**. This is a direct account takeover risk.

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Account takeover vulnerability in Golo Theme. <br>💥 **Consequences**: Unauthenticated users can change **ANY** user's password. Full account compromise possible.

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-862 (Missing Authorization). <br>🔍 **Flaw**: The plugin fails to verify if the user requesting a password change is the owner of the account. No access control check.

Q3Who is affected? (Versions/Components)

📦 **Affected**: WordPress Plugin: **Golo - City Travel Guide WordPress Theme**. <br>📉 **Version**: **1.6.10** and earlier. <br>🏢 **Vendor**: uxper.

Q4What can hackers do? (Privileges/Data)

👮 **Hackers Can**: Reset passwords for **arbitrary users** (Admins, Editors, etc.). <br>🔓 **Privileges**: Gain full administrative access without needing initial login credentials.

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. <br>🌐 **Auth**: **None required** (PR:N). <br>🖱️ **UI**: **None required** (UI:N). <br>📡 **Network**: Remote (AV:N). Easy to exploit.

Q6Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exp?**: No specific PoC code provided in data. <br>🌍 **Wild Exp**: Likely low volume currently, but high impact makes it attractive. Check WordFence Intel for active threats.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for **Golo Theme** version **1.6.10** or lower. <br>🧪 **Test**: Attempt password reset for a test account without being logged in. If it works, you are vulnerable.

Q8Is it fixed officially? (Patch/Mitigation)

🔧 **Fix**: Update to the latest version of **Golo - City Travel Guide WordPress Theme**. <br>✅ **Status**: Patch available from vendor (uxper) via ThemeForest/WordPress repo.

Q9What if no patch? (Workaround)

🚧 **No Patch?**: Disable the theme immediately. <br>🛑 **Mitigation**: Switch to a default WordPress theme temporarily. <br>🔒 **Access**: Monitor admin logs for suspicious password change activities.

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. <br>📈 **Priority**: **P1**. CVSS Score is **High** (9.8 implied by H/I/H). <br>⏱️ **Action**: Patch **IMMEDIATELY**. This is a direct account takeover risk.

Continue exploring

Vulnerability detail Full AI analysis (login) uxper CWE-862