CVE-2025-8944

MediumCVSS 4.3/10Last modified Sep 30, 2026

Description

The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Unknown	OceanWP	< 4.1.2

References

https://wpscan.com/vulnerability/cf77b7f2-525b-4fe8-b612-185a1c18c197/Exploit, Third Party Advisory

Timeline

Published: Sep 5, 2025
Last modified: Sep 30, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-89455.3The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using th CVE-2025-89469.8A vulnerability has been found in projectworlds Online Notes Sharing Platform 1.0. This vulnerability affects unknown code of the file /logi CVE-2025-89479.8A vulnerability was found in projectworlds Visitor Management System 1.0. This issue affects some unknown processing of the file /query_data CVE-2025-89489.8A vulnerability was determined in projectworlds Visitor Management System 1.0. Affected is an unknown function of the file /front.php. The m CVE-2025-89499.8A vulnerability was identified in D-Link DIR-825 2.10. Affected by this vulnerability is the function get_ping_app_stat of the file ping_res CVE-2025-89509.8A vulnerability was identified in Campcodes Online Recruitment Management System 1.0. This issue affects some unknown processing of the file CVE-2025-89519.8A vulnerability has been found in PHPGurukul Teachers Record Management System 2.1. Affected is an unknown function of the file /admin/searc CVE-2025-89529.8A vulnerability was found in Campcodes Online Flight Booking Management System 1.0. Affected by this vulnerability is an unknown functionali CVE-2025-89539.8A vulnerability was determined in SourceCodester COVID 19 Testing Management System 1.0. Affected by this issue is some unknown functionalit CVE-2025-89549.8A vulnerability was identified in PHPGurukul Hospital Management System 4.0. This affects an unknown part of the file /admin/doctor-speciliz CVE-2025-89559.8A vulnerability has been found in PHPGurukul Hospital Management System 4.0. This vulnerability affects unknown code of the file /admin/edit CVE-2025-89568.8A vulnerability was found in D-Link DIR‑818L up to 1.05B01. This issue affects the function getenv of the file /htdocs/cgibin of the compone