An unauthorized capability check in the Mavix Education WordPress theme allows authenticated users with Subscriber-level access or higher to activate the Creativ Demo Importer plugin through the 'mavix_education_activate_plugin' AJAX call. This flaw permits users to enable a plugin they should not control, potentially changing site behavior or loading additional code. The weakness is identified by CWE-862, indicating a missing authorization check.

WordPress sites running the Mavix Education theme by creativthemes, all released versions up to and including 1.0.

The CVSS base score of 4.3 classifies the issue as moderate, while the EPSS score of less than 1% indicates exploitation is unlikely in the short term. The flaw is accessible only to authenticated users, requiring at least Subscriber privileges to attempt exploitation. Because the AJAX endpoint lacks a capability check, any user with those credentials can activate the plugin, providing a simple vector for unauthorized plugin activation on affected sites. The vulnerability is not currently listed in the CISA KEV catalog, supporting the low exploitation probability assessment.