PT-2025-51051 · WordPress · Mavix Education Theme

Published 2025-12-13 · Updated 2025-12-13 · CVE-2025-11164

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mavix Education theme for WordPress versions 1.0 and earlier

Description The Mavix Education theme for WordPress has an issue where data can be modified without authorization. This is due to a missing capability check on the mavix education activate plugin AJAX action. Attackers with Subscriber-level access or higher can activate the Creativ Demo Importer plugin. The vulnerable component is the mavix education activate plugin AJAX action.

Recommendations Update to a version of the Mavix Education theme for WordPress that addresses this issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-11164

Affected Products

Mavix Education Theme

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-11164 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a8e57528-010f-4ec6-917b-4cd8c3fdbd58?source=cve · Note
• https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=297888%40mavix-education&new=297888%40mavix-education · Note
• https://t.me/CVEtracker/39701 · Telegram Post
• https://twitter.com/CVEnew/status/1999865348385087569 · Twitter Post