CVE-2025-0951: Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the…

PriorityP422medium4.3CVSS 3.1

AVNACLPRLUINSUCNILAN

EPSS

0.18%

8.0th percentile

Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpress_before AJAX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate all of a site's plugins. While we escalated this to Envato after not being able to establish contact, it appears the developer added a nonce check, however that is not sufficient protection as the nonce is exposed to all users with access to the dashboard.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
liquidthemes	ai_hub_startup_technology_wordpress_theme	—	—
liquidthemes	archub_architecture_and_interior_design_wordpress_theme	—	—
liquidthemes	hub_responsive_multi-purpose_wordpress_theme	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.