CVE-2025-8944

MediumCVSS 4.3

Published: 05/09/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

Vulnerability in OceanWP WordPress theme (before 4.1.2) due to a missing capability check on one of its AJAX request handlers, allowing any authenticated users, such as subscribers, to update the 'darkMod' setting.

Risk Assessment

Risk of unauthorized modification of theme settings, potentially leading to visual changes or security issues.

Recommendation

Update OceanWP theme to version 4.1.2 or later and ensure capability checks are enforced for all AJAX actions.

Other vulnerabilities in OceanWP

CVE-2026-115592High
The OceanWP plugin for WordPress contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions from n/a through 4.2.7.

Original NVD description (English source)

The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS