Description
The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_theme_admin, display_method_admin, and set_change_theme_button_name actions actions in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin's settings.
Published: 2025-12-12
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized update of plugin settings by authenticated users with subscriber role or higher
Action: Immediate Patch
AI Analysis

Impact

The Simple Theme Changer plugin contains missing capability checks on the user_theme_admin, display_method_admin, and set_change_theme_button_name Ajax actions in all versions up to 1.0. This flaw allows an authenticated attacker who is a subscriber or higher to modify the plugin's settings, potentially changing the site's theme or related display options. The weakness is a missing permission check, classified as CWE‑862.

Affected Systems

WordPress sites using the Simple Theme Changer plugin by darendev, versions 1.0 and earlier.

Risk and Exploitability

The CVSS score of 4.3 indicates low to moderate severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation, and the vulnerability is not listed in CISA's KEV catalog. Attackers need to be authenticated and possess at least subscriber privileges, after which they can issue Ajax requests to the vulnerable actions.

Generated by OpenCVE AI on April 21, 2026 at 17:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Simple Theme Changer plugin to the latest version that includes the missing capability check.
  • If an update is not available, restrict the affected Ajax actions to users with administrator privileges or add an explicit capability check in these endpoints.
  • Disable or remove the plugin if it is not essential to site functionality.

Generated by OpenCVE AI on April 21, 2026 at 17:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 15 Dec 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 12 Dec 2025 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Fri, 12 Dec 2025 03:45:00 +0000

Type Values Removed Values Added
Description The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_theme_admin, display_method_admin, and set_change_theme_button_name actions actions in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin's settings.
Title Simple Theme Changer <= 1.0. - Missing Authorization to Plugin Settings Update via AJAX Actions
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:05:13.299Z

Reserved: 2025-12-09T21:22:03.662Z

Link: CVE-2025-14392

cve-icon Vulnrichment

Updated: 2025-12-12T20:14:17.327Z

cve-icon NVD

Status : Deferred

Published: 2025-12-12T04:15:50.110

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-14392

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T17:30:37Z

Weaknesses