CVE-2025-8944 — OceanWP < 4.1.2 - Subscriber+ Limited Option Update

CVE-2025-8944

OceanWP < 4.1.2 - Subscriber+ Limited Option Update PUBLISHED

Description (CNA)

The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting.

Affected (CNA)

Vendor / product	Versions
Unknown / OceanWP	affected 0 before 4.1.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/cf77b7f2-525b-4fe8-b612-185a1c18c197/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.