CVE-2015-10143: The Platform theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on…

PriorityP275critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

1.80%

75.8th percentile

The Platform theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the *_ajax_save_options() function in all versions up to 1.4.4 (exclusive). This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
pagelines	platform	< 1.4.4	1.4.4
pagelines	platform_theme	< 1.4.4	1.4.4

Detection & IOCsextracted from sources · hover to see the quote

urlhttps://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_platform_exec.rb↗

→Monitor for unauthenticated requests invoking the *_ajax_save_options() function in the Platform WordPress theme, which lacks capability checks and can be used to modify arbitrary site options. ↗
→Alert on changes to WordPress options 'default_role' being set to 'administrator' and 'users_can_register' being enabled, as these are the privilege escalation indicators for this CVE. ↗
→Detect PHP file inclusion of uploaded files via temp filenames, as the Platform theme includes uploaded files using PHP's include function without validation. ↗
→Monitor for unauthenticated file upload attempts targeting the Platform WordPress theme via admin_init hooks, which can lead to remote code execution. ↗

·The vulnerability affects all versions of the Platform theme for WordPress strictly below 1.4.4; ensure version scoping is applied when deploying detections. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.