CVE-2025-1778: Art Theme <= 3.12.2.3 - Missing Authorization to Authenticated (Subscriber+) Theme Option Delete

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-06 · updated 2026-06-17
Weakness: CWE-862

Description

The Art Theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'arttheme_theme_option_restore' AJAX function in all versions up to, and including, 3.12.2.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete the theme option.

Affected products

SeaTheme Art Theme: through 3.12.2.3

References

https://themeforest.net/item/art-simple-clean-wordpress-theme-for-creatives/20170299
https://www.wordfence.com/threat-intel/vulnerabilities/id/c54c1fab-634d-4d1a-8234-8f1ae41c7cd4?source=cve

Get alerted when CVE-2025-1778 or the next vulnerability affects your stack