CVE-2025-11164 is a missing authorization vulnerability (CWE-862) in the Mavix Education WordPress theme by creativthemes. The issue arises because the AJAX action 'mavix_education_activate_plugin' does not perform a capability check, enabling any authenticated user with Subscriber-level privileges or above to activate the Creativ Demo Importer plugin. This could lead to unauthorized modification of site data or functionality. The vulnerability affects all versions up to 1.0. The CVSS v3.1 base score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting a network attack vector with low complexity, requiring low privileges, no user interaction, unchanged scope, no confidentiality or availability impact, but low integrity impact.

An attacker with at least Subscriber-level access can activate a plugin without proper authorization, potentially modifying site behavior or data. While this does not directly impact confidentiality or availability, it poses a risk to the integrity of the WordPress site by enabling unauthorized plugin activation.

No official patch or remediation is currently available. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict user roles to trusted individuals only and consider disabling or limiting AJAX actions if possible through custom code or security plugins. Avoid granting Subscriber-level or higher access to untrusted users.