Cyber Posture

CVE-2025-0952

High

Published: 14 March 2025

Published
14 March 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS Score 0.0010 26.8th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

Security Summary

CVE-2025-0952 affects the Eco Nature - Environment & Ecology WordPress Theme for WordPress, impacting all versions up to and including 2.0.4. The vulnerability stems from a missing capability check on the 'cmsmasters_hide_admin_notice' AJAX action, enabling unauthorized modification of data. This flaw, classified under CWE-862 (Missing Authorization), has a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), highlighting high integrity and availability impacts with no confidentiality loss.

Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability remotely without user interaction. By leveraging the unprotected AJAX endpoint, they can update WordPress option values to 'hide,' potentially triggering site errors that deny service to legitimate users. Attackers could also manipulate specific options, such as enabling registration, to further disrupt or alter site functionality.

Advisories detailing the issue are available from sources including Wordfence and the theme's ThemeForest page. Published on 2025-03-14, no specific patch or mitigation details beyond updating the theme are outlined in the core description.

Details

CWE(s)
CWE-862

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1565.001 Stored Data Manipulation Impact
Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
Why these techniques?

Vulnerability in public-facing WordPress theme allows authenticated attackers to exploit missing authorization on AJAX action for unauthorized modification of stored options, enabling data manipulation and potential DoS via site errors.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

References