CVE-2025-8999 is a missing authorization vulnerability (CWE-862) in the Sydney theme for WordPress. The issue arises from the lack of a capability check in the 'activate_modules' function, enabling authenticated users with minimal privileges (Subscriber-level and above) to modify theme modules by activating or deactivating them. This could lead to unauthorized changes in theme behavior or functionality. The vulnerability affects all versions up to and including 2.56. The CVSS 3.1 base score is 5.3, indicating medium severity, with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact is low.

The vulnerability allows authenticated users with Subscriber-level access or higher to modify theme modules without proper authorization. This could result in unauthorized changes to the theme's functionality or appearance, potentially affecting site integrity. There is no direct impact on confidentiality or availability reported. No known exploits are currently documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, it is recommended to monitor the vendor's announcements for updates. Until a fix is available, consider restricting Subscriber-level access or higher to trusted users only to reduce risk.