Unauthorized Data Modification in Cardealer Theme for WordPress
CVE-2025-1681

5.4MEDIUM

Key Information:

Vendor
WordPress
Status
Car Dealer Automotive WordPress Theme – Responsive
Vendor
CVE Published:
28 February 2025

Summary

The Cardealer theme for WordPress is susceptible to unauthorized data modifications due to a lack of capability checks and inadequate filename sanitization within its demo theme scheme AJAX functions. This vulnerability affects versions up to and including 1.6.4, enabling authenticated attackers with subscriber-level access and higher to alter or delete arbitrary CSS and JS files, potentially leading to data loss or manipulation on affected websites.

Affected Version(s)

Car Dealer Automotive WordPress Theme – Responsive * <= 1.6.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://themeforest.net/item/car-dealer-automotive-wordpr...
https://webtemplatemasters.com/cardealer/changelog/#v165

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.