Unauthorized Data Modification in Spacious Theme for WordPress by ThemeIsle

CVE-2025-9331

What is CVE-2025-9331?

The Spacious theme for WordPress has a vulnerability that allows unauthorized data modification due to a missing capability check in the 'welcome_notice_import_handler' function. This issue affects all versions up to and including 1.9.11. Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability to import demo data into the site, which may lead to compromising the site's integrity. Site administrators should apply the latest patches to prevent potential misuse.

References