medium4.3
CVE-2025-8944
The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any a…
Impact
The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Oceanwp | Oceanwp | before 4.1.2 |