CVE-2025-0952

Summary

CVE-2025-0952 is a vulnerability affecting the Eco Nature - Environment & Ecology WordPress Theme. This issue allows authenticated attackers, with Subscriber-level access or higher, to manipulate data without proper capability checks. Specifically, the 'cmsmasters_hide_admin_notice' AJAX action in all versions up to 2.0.4 is missing capability checks. Attackers can exploit this flaw to update option values and create denial-of-service conditions by introducing errors on the site. Alternatively, they could set specific values to true, such as enabling user registration.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.