Medium severity4.3NVD Advisory· Published Mar 14, 2025· Updated Jun 17, 2026

CVE-2025-2289

Description

The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import, export, and update theme options.

Affected products

zozothemes/Zegen
cpe:2.3:a:zozothemes:zegen:*:*:*:*:*:wordpress:*:*
Range: <=1.1.9
WordPress/Zegen - Church WordPress Themellm-create
Range: <=1.1.9
zozothemes/Zegen - Church WordPress Themev5
Range: 0
WordPress/Zegenwp-canonicalize

Patches

Vulnerability mechanics

References

www.wordfence.com/threat-intel/vulnerabilities/id/a04db024-5198-490f-bf5f-d5bad1b21ce4nvdThird Party Advisory
themeforest.net/item/zegen-church-wordpress-theme/25116823nvdProduct

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000