CVE-2025-0952

High

Published: 14 March 2025

Published

14 March 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS Score 0.0010 26.8th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-0952 is a high-severity Missing Authorization (CWE-862) vulnerability in Themeforest (inferred from references). Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations on the 'cmsmasters_hide_admin_notice' AJAX action to prevent unauthorized modification of WordPress options by subscriber-level users.

AC-6 Least Privilege good match

prevent

Applies least privilege to restrict subscriber-level accounts from accessing or modifying sensitive site options via unprotected AJAX endpoints.

CM-5 Access Restrictions for Change good match

prevent

Restricts logical access to changes in WordPress configuration options, mitigating unauthorized updates that lead to denial of service.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1565.001 Stored Data Manipulation Impact

Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

attack.mitre.org →

Why these techniques?

Vulnerability in public-facing WordPress theme allows authenticated attackers to exploit missing authorization on AJAX action for unauthorized modification of stored options, enabling data manipulation and potential DoS via site errors.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

NVD Description

The Eco Nature - Environment & Ecology WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cmsmasters_hide_admin_notice' AJAX action in all…

versions up to, and including, 2.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to 'hide' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.

Deeper analysisAI

CVE-2025-0952 affects the Eco Nature - Environment & Ecology WordPress Theme for WordPress, impacting all versions up to and including 2.0.4. The vulnerability stems from a missing capability check on the 'cmsmasters_hide_admin_notice' AJAX action, enabling unauthorized modification of data. This flaw, classified under CWE-862 (Missing Authorization), has a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), highlighting high integrity and availability impacts with no confidentiality loss.

Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability remotely without user interaction. By leveraging the unprotected AJAX endpoint, they can update WordPress option values to 'hide,' potentially triggering site errors that deny service to legitimate users. Attackers could also manipulate specific options, such as enabling registration, to further disrupt or alter site functionality.

Advisories detailing the issue are available from sources including Wordfence and the theme's ThemeForest page. Published on 2025-03-14, no specific patch or mitigation details beyond updating the theme are outlined in the core description.