CVE-2025-8595
Zakra <= 4.1.5 - Missing Authorization to Subscriber+ Demo Import
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Zakra <= 4.1.5 - Missing Authorization to Subscriber+ Demo Import
The Zakra theme for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the welcome_notice_import_handler() function in all versions up to, and including, 4.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import demo settings.
Reserved 2025-08-05 | Published 2025-08-06 | Updated 2025-08-06 | Assigner Wordfence| 2025-08-05: | Disclosed |
Dmitrii Ignatyev
www.wordfence.com/...-7e58-479a-813e-762eb28297bf?source=cve
themes.trac.wordpress.org/....1.6&old=276128%40zakra%2F4.1.5
research.cleantalk.org/cve-2025-8595/
Support options
