CVE-2025-2289
Published: 14 March 2025
Summary
CVE-2025-2289 is a medium-severity Missing Authorization (CWE-862) vulnerability in Zozothemes Zegen. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-2289 affects the Zegen Church WordPress Theme for WordPress, enabling unauthorized access due to a missing capability check on several AJAX endpoints. This vulnerability impacts all versions up to and including 1.1.9 and is classified under CWE-862 (Missing Authorization). It carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), indicating a moderate risk with network accessibility, low attack complexity, and low privileges required.
Authenticated attackers possessing Subscriber-level access or higher can exploit the vulnerability remotely without user interaction. Exploitation allows them to import, export, and update theme options, resulting in unauthorized integrity impacts such as modification of theme configurations.
Mitigation guidance is available in advisories including the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/a04db024-5198-490f-bf5f-d5bad1b21ce4?source=cve and the theme's product page on ThemeForest at https://themeforest.net/item/zegen-church-wordpress-theme/25116823. The vulnerability was published on 2025-03-14T06:15:25.230.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7557
Vulnerability details
The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with…
more
Subscriber-level access and above, to import, export, and update theme options.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes exploitation of a missing authorization vulnerability in a public-facing WordPress theme via authenticated AJAX requests, directly enabling T1190 for initial access or unauthorized actions in an Internet-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources, directly addressing the missing capability checks on AJAX endpoints that enable unauthorized theme option modifications.
Employs least privilege to restrict Subscriber-level users from performing unauthorized import, export, and update actions on theme options.
Requires timely identification, reporting, and correction of flaws like the missing authorization in the Zegen theme, eliminating the vulnerability through remediation.