CVE-2025-2289 describes a missing authorization vulnerability in the Zegen - Church WordPress Theme by zozothemes. The issue arises from the absence of capability checks on several AJAX endpoints, permitting authenticated users with low-level privileges (Subscriber and above) to perform unauthorized actions such as importing, exporting, and updating theme options. This could lead to unauthorized modification of theme settings. The vulnerability affects all versions up to and including 1.1.9. The CVSS score is 4.3, reflecting a medium impact primarily on integrity without affecting confidentiality or availability.

An attacker with authenticated Subscriber-level access or higher can modify theme options without proper authorization, potentially altering site appearance or behavior. The vulnerability does not impact confidentiality or availability according to the CVSS vector. There are no known exploits in the wild, and no direct evidence of widespread abuse.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and consider disabling or limiting access to the affected AJAX endpoints if possible. Monitor for updates from zozothemes regarding patches or official mitigations.