Access Control Flaw in Themes4WP Bulk Plugin for WordPress

CVE-2025-26867

What is CVE-2025-26867?

A missing authorization vulnerability exists in the Themes4WP Bulk plugin, which allows unauthorized access to functionality that should be restricted by access control lists (ACLs). This flaw potentially enables malicious actors to exploit the plugin and perform actions without proper authentication, putting user data and site integrity at risk. It is crucial for users of the affected versions to implement necessary updates and security measures to safeguard their WordPress sites.

References