Unauthorized Access Vulnerability in LiquidThemes' WordPress Products

CVE-2025-0951

What is CVE-2025-0951?

LiquidThemes' WordPress plugins and themes contain a vulnerability that allows authenticated attackers with Subscriber-level access and higher to bypass capability checks. The missing capability check on the 'liquid_reset_wordpress_before' AJAX function can lead to the deactivation of all site plugins. Although a nonce check was implemented to provide some protection, it is insufficient since the nonce can be accessed by all users with dashboard privileges, leaving the site vulnerable to exploitation.

References