CVE-2025-0951

LiquidThemes Themes <= Various Versions - Missing Authorization to Authenticated (Subscriber+) All Plugins Deactivated

Published Aug 28, 2025 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpress_before AJAX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate all of a site's plugins. While we escalated this to Envato after not being able to establish contact, it appears the developer added a nonce check, however that is not sufficient protection as the nonce is exposed to all users with access to the dashboard.

Analysis

Technical impact

The vulnerability originates from a missing capability check in the liquid_reset_wordpress_before AJAX handler used by several LiquidThemes WordPress themes. As a result, any authenticated user with Subscriber role or higher can trigger this endpoint and deactivate every plugin on the site. The flaw falls under CWE‑862 (Missing Authorization) and can cause a denial of service by stripping core functionality, potentially leading to site downtime or degraded user experience.

Affected Systems

The flaw affects the AI Hub, ArcHub and Hub WordPress themes released by LiquidThemes. All supported versions prior to the recent update that added a nonce check are vulnerable. The specific version range is not enumerated in the advisory.

Risk and Exploitability

The CVSS score of 4.3 indicates a moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The attack requires only authenticated access with Subscriber-level permissions and does not require elevated administrative rights, meaning a wide range of users could abuse it if the theme remains outdated. Though listed as not in the CISA KEV catalog, the potential for site-wide disruption warrants prompt remediation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

LiquidThemes

AI Hub - Startup & Technology WordPress Theme

unaffected

Version	Status	Constraints
`0`	affected	—

LiquidThemes

Hub - Responsive Multi-Purpose WordPress Theme

unaffected

Version	Status	Constraints
`0`	affected	—

LiquidThemes

ArcHub - Architecture and Interior Design WordPress Theme

unaffected

Version	Status	Constraints
`0`	affected	—

No data.

Vendor	Product	Versions
Liquidthemes	Ai Hub	—
Liquidthemes	Archub	—
Liquidthemes	Hub	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update all LiquidThemes AI Hub, ArcHub, and Hub themes to the latest releases where the nonce check has been added to the liquid_reset_wordpress_before handler.
Verify that the nonce is not exposed publicly on the dashboard and that the capability check limits access to the required roles; if uncertain, reconfigure the theme’s AJAX endpoint to restrict access to administrators only.
If an immediate theme update is not feasible, temporarily disable the liquid_reset_wordpress_before AJAX route by adding a custom function to your theme’s functions.php or a site‑wide plugin that removes or blocks this action for non‑administrator users.

Generated by OpenCVE AI on April 28, 2026 at 10:52 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-25959	Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpress_before AJAX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate all of a site's plugins. While we escalated this to Envato after not being able to establish contact, it appears the developer added a nonce check, however that is not sufficient protection as the nonce is exposed to all users with access to the dashboard.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.200% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://themeforest.net/user/liquidthemes
https://www.wordfence.com/threat-intel/vulnerabilities/id/0099c700-e1af-4d97-a518-151a9139ea35?source=cve

History

Feb 27, 2026 12:15 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 28, 2025 7:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Liquidthemes Liquidthemes ai Hub Liquidthemes archub Liquidthemes hub Wordpress Wordpress wordpress
Vendors & Products		Liquidthemes Liquidthemes ai Hub Liquidthemes archub Liquidthemes hub Wordpress Wordpress wordpress

Aug 28, 2025 4:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpress_before AJAX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate all of a site's plugins. While we escalated this to Envato after not being able to establish contact, it appears the developer added a nonce check, however that is not sufficient protection as the nonce is exposed to all users with access to the dashboard.
Title		LiquidThemes Themes <= Various Versions - Missing Authorization to Authenticated (Subscriber+) All Plugins Deactivated
Weaknesses		CWE-862
References		https://themeforest.net/user/liquidthemes https://www.wordfence.com/threat-intel/vulnerabilities/id/0099c700-e1af-4d97-a518-151a9139ea35?source=cve
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`