4.3
Medium
CVE-2025-8944 The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of…
Description
The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| OceanWP 4.1 | earliest → < 4.1.2 | 4.1.2 |