CVE-2025-2238 describes a privilege escalation vulnerability in the Vikinger WordPress theme by Odin_Design. The issue arises from insufficient restrictions on user_meta updates within the 'vikinger_user_meta_update_ajax' function, allowing authenticated users with low-level privileges (Subscriber and above) to escalate to Administrator privileges. This vulnerability affects all versions up to and including 1.9.30. The CVSS 3.1 score of 8.8 indicates a high impact with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows an authenticated user with Subscriber-level access or higher to escalate privileges to Administrator, potentially leading to full site compromise including content modification, user management, and configuration changes. This can severely impact the confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to trusted users only and consider disabling or removing the Vikinger theme if possible. Monitor for updates from Odin_Design and apply patches promptly once available.