Unauthorized Data Modification in Sydney Theme for WordPress

CVE-2025-8999

What is CVE-2025-8999?

The Sydney theme for WordPress is susceptible to unauthorized data modification due to a missing capability check in the 'activate_modules' function. This vulnerability affects all versions up to and including 2.56, allowing authenticated users with Subscriber-level access and higher to activate or deactivate theme modules without proper authorization. As a result, this could lead to significant changes in the site's functionality and potential exploitation by malicious users.

References