CVE-2025-9331 Spacious <= 1.9.11 - Missing Authorization to Autheticated (Subscriber+) Demo Data Import
MediumCVSS 4.3
EPSS 0.34%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Spacious theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'welcome_notice_import_handler' function in all versions up to, and including, 1.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to import demo data into the site.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wordpress spacious(WordPress) | < 1.9.12 | 1.9.12 |
| ThemeGrill Spacious | <= 1.9.11 | No fix listed |
References
- Wordfence Intelligence third-party-advisory
- www.cve.org
- www.wordfence.com
- themes.trac.wordpress.org
- research.cleantalk.org