CVE-2025-8944

MediumCVSS 4.3/10Last modified Sep 30, 2026

Description

The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Sep 5, 2025
Last modified
Sep 30, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-89455.3The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using thCVE-2025-89469.8A vulnerability has been found in projectworlds Online Notes Sharing Platform 1.0. This vulnerability affects unknown code of the file /logiCVE-2025-89479.8A vulnerability was found in projectworlds Visitor Management System 1.0. This issue affects some unknown processing of the file /query_dataCVE-2025-89489.8A vulnerability was determined in projectworlds Visitor Management System 1.0. Affected is an unknown function of the file /front.php. The mCVE-2025-89499.8A vulnerability was identified in D-Link DIR-825 2.10. Affected by this vulnerability is the function get_ping_app_stat of the file ping_resCVE-2025-89509.8A vulnerability was identified in Campcodes Online Recruitment Management System 1.0. This issue affects some unknown processing of the fileCVE-2025-89519.8A vulnerability has been found in PHPGurukul Teachers Record Management System 2.1. Affected is an unknown function of the file /admin/searcCVE-2025-89529.8A vulnerability was found in Campcodes Online Flight Booking Management System 1.0. Affected by this vulnerability is an unknown functionaliCVE-2025-89539.8A vulnerability was determined in SourceCodester COVID 19 Testing Management System 1.0. Affected by this issue is some unknown functionalitCVE-2025-89549.8A vulnerability was identified in PHPGurukul Hospital Management System 4.0. This affects an unknown part of the file /admin/doctor-specilizCVE-2025-89559.8A vulnerability has been found in PHPGurukul Hospital Management System 4.0. This vulnerability affects unknown code of the file /admin/editCVE-2025-89568.8A vulnerability was found in D-Link DIR‑818L up to 1.05B01. This issue affects the function getenv of the file /htdocs/cgibin of the compone