CVE-2025-8999

Name of the Vulnerable Software and Affected Versions Sydney theme for WordPress versions prior to 2.57

Description The Sydney theme for WordPress is susceptible to unauthorized data modification due to a missing capability check on the activate modules() function. This allows authenticated attackers with Subscriber-level access or higher to activate or deactivate theme modules.

Recommendations Update the Sydney theme to version 2.57 or later. As a temporary workaround, restrict access for users with Subscriber-level access or lower.