Vulnerability · Published Aug 28, 2025 · Assigned by Wordfence

CVE-2025-0951LiquidThemes Themes <= Various Versions - Missing Authorization to Authenticated (Subscriber+) All Plugins Deactivated

Medium 4.3

In plain English

A medium-severity missing authorization in AI Hub - Startup & Technology WordPress Theme from LiquidThemes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 90.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpress_before AJAX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate all of a site's plugins. While we escalated this to Envato after not being able to establish contact, it appears the developer added a nonce check, however that is not sufficient protection as the nonce is exposed to all users with access to the dashboard.

Affected products (as reported)

Vendor	Product	Versions
LiquidThemes	AI Hub - Startup & Technology WordPress Theme	0
LiquidThemes	Hub - Responsive Multi-Purpose WordPress Theme	0
LiquidThemes	ArcHub - Architecture and Interior Design WordPress Theme	0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

In plain English

Official description

Affected products (as reported)

References