CVE-2025-2289

Name of the Vulnerable Software and Affected Versions: The Zegen - Church WordPress Theme versions prior to 1.1.9

Description: The issue is related to unauthorized access due to a missing capability check on several AJAX endpoints. This allows authenticated attackers with Subscriber-level access and above to import, export, and update theme options.

Recommendations: For versions prior to 1.1.9, update to a version that includes the necessary capability checks to prevent unauthorized access. As a temporary workaround, consider restricting access to the affected AJAX endpoints until a patch is available.