CVE-2025-14392

Simple Theme Changer <= 1.0. - Missing Authorization to Plugin Settings Update via AJAX Actions

Published Dec 12, 2025 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_theme_admin, display_method_admin, and set_change_theme_button_name actions actions in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin's settings.

Analysis

Technical impact

The Simple Theme Changer plugin contains missing capability checks on the user_theme_admin, display_method_admin, and set_change_theme_button_name Ajax actions in all versions up to 1.0. This flaw allows an authenticated attacker who is a subscriber or higher to modify the plugin's settings, potentially changing the site's theme or related display options. The weakness is a missing permission check, classified as CWE‑862.

Affected Systems

WordPress sites using the Simple Theme Changer plugin by darendev, versions 1.0 and earlier.

Risk and Exploitability

The CVSS score of 4.3 indicates low to moderate severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Attackers need to be authenticated and possess at least subscriber privileges, after which they can issue Ajax requests to the vulnerable actions.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

darendev

Simple Theme Changer

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.0

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Simple Theme Changer plugin to the latest version that includes the missing capability check.
If an update is not available, restrict the affected Ajax actions to users with administrator privileges or add an explicit capability check in these endpoints.
Disable or remove the plugin if it is not essential to site functionality.

Generated by OpenCVE AI on April 21, 2026 at 17:27 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.201% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/simple-theme-changer/tags/1.0/class_theme_changer.php#L262
https://www.wordfence.com/threat-intel/vulnerabilities/id/880712ee-373f-49e7-93e3-968f3a0f3f83?source=cve

History

Dec 15, 2025 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Dec 12, 2025 9:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress
Vendors & Products		Wordpress Wordpress wordpress

Dec 12, 2025 3:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_theme_admin, display_method_admin, and set_change_theme_button_name actions actions in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin's settings.
Title		Simple Theme Changer <= 1.0. - Missing Authorization to Plugin Settings Update via AJAX Actions
Weaknesses		CWE-862
References		https://plugins.trac.wordpress.org/browser/simple-theme-changer/tags/1.0/class_theme_changer.php#L262 https://www.wordfence.com/threat-intel/vulnerabilities/id/880712ee-373f-49e7-93e3-968f3a0f3f83?source=cve
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`