CVE-2024-8430: Spicethemes Spice Starter Sites

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spice_starter_sites_importer_creater function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to import demo content.

Affected products

• Spicethemes Spice Starter Sites: up to and including 1.2.5

Published 2024-10-01. Last modified 2026-06-17.