CVE-2025-2289
Published: 14 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-2289 affects the Zegen Church WordPress Theme for WordPress, enabling unauthorized access due to a missing capability check on several AJAX endpoints. This vulnerability impacts all versions up to and including 1.1.9 and is classified under CWE-862 (Missing Authorization). It carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), indicating a moderate risk with network accessibility, low attack complexity, and low privileges required.
Authenticated attackers possessing Subscriber-level access or higher can exploit the vulnerability remotely without user interaction. Exploitation allows them to import, export, and update theme options, resulting in unauthorized integrity impacts such as modification of theme configurations.
Mitigation guidance is available in advisories including the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/a04db024-5198-490f-bf5f-d5bad1b21ce4?source=cve and the theme's product page on ThemeForest at https://themeforest.net/item/zegen-church-wordpress-theme/25116823. The vulnerability was published on 2025-03-14T06:15:25.230.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CVE describes exploitation of a missing authorization vulnerability in a public-facing WordPress theme via authenticated AJAX requests, directly enabling T1190 for initial access or unauthorized actions in an Internet-facing application.