CVE-2025-0951: falha de média gravidade em LiquidThemes AI Hub - Startup & Technology…
LiquidThemes Themes <= Various Versions - Missing Authorization to Authenticated (Subscriber+) All Plugins Deactivated
Publicada em · Atualizada em
Seguir esta CVE+ Monitorar AI Hub - Startup & Technology WordPress Theme+ Monitorar ArcHub - Architecture and Interior Design WordPress Theme
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.2%
Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpress_before AJAX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate all of a site's plugins. While we escalated this to Envato after not being able to establish contact, it appears the developer added a nonce check, however that is not sufficient protection as the nonce is exposed to all users with access to the dashboard.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
LiquidThemes · AI Hub - Startup & Technology WordPress ThemeLiquidThemes · ArcHub - Architecture and Interior Design WordPress ThemeLiquidThemes · Hub - Responsive Multi-Purpose WordPress ThemeCVEs relacionadas — LiquidThemes AI Hub - Startup & Technology…
No mesmo produto, das mais perigosas para as menos.