CVE-2025-9194 is a missing authorization vulnerability (CWE-862) in the Constructor WordPress theme by antonshevchuk. The issue arises because the clean() function lacks a capability check, enabling authenticated users with low privileges (Subscriber and above) to invoke a theme clean operation. This could lead to unauthorized modification of theme data. The vulnerability affects all versions up to and including 1.6.5. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

The vulnerability allows authenticated users with Subscriber-level access or higher to perform unauthorized modifications to theme data by triggering the clean() function. This impacts data integrity but does not affect confidentiality or availability. The medium CVSS score reflects this limited impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access where possible and monitor for suspicious activity related to theme cleaning operations. Avoid granting unnecessary privileges to low-level authenticated users.