Unauthorized Access Vulnerability in LiquidThemes' WordPress Products

CVE-2025-0951

What is CVE-2025-0951?

LiquidThemes' WordPress plugins and themes contain a vulnerability that allows authenticated attackers with Subscriber-level access and higher to bypass capability checks. The missing capability check on the 'liquid_reset_wordpress_before' AJAX function can lead to the deactivation of all site plugins. Although a nonce check was implemented to provide some protection, it is insufficient since the nonce can be accessed by all users with dashboard privileges, leaving the site vulnerable to exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References