Unauthorized Data Modification in Cardealer Theme for WordPress

CVE-2025-1681

What is CVE-2025-1681?

The Cardealer theme for WordPress is susceptible to unauthorized data modifications due to a lack of capability checks and inadequate filename sanitization within its demo theme scheme AJAX functions. This vulnerability affects versions up to and including 1.6.4, enabling authenticated attackers with subscriber-level access and higher to alter or delete arbitrary CSS and JS files, potentially leading to data loss or manipulation on affected websites.

References