Skip to content
Sign in
4.3 Medium

CVE-2025-0951 Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing…

Description

Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpress_before AJAX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate all of a site's plugins. While we escalated this to Envato after not being able to establish contact, it appears the developer added a nonce check, however that is not sufficient protection as the nonce is exposed to all users with access to the dashboard.

Affected products and versions

Product Affected versions Fixed in
AI Hub - Startup & Technology WordPress Theme 0 No fix stated
Hub - Responsive Multi-Purpose WordPress Theme 0 No fix stated
ArcHub - Architecture and Interior Design WordPress Theme 0 No fix stated

Other CVEs of AI Hub - Startup & Technology WordPress Theme

The 2 CVEs of AI Hub - Startup & Technology WordPress Theme →
CVE-2025-1093 The AIHub theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the… 9.8 Critical
Track this CVE