CVE-2025-0951: LiquidThemes WordPress Auth Bypass Vulnerability

CVE-2025-0951 Overview

CVE-2025-0951 affects multiple WordPress plugins and themes developed by LiquidThemes. The vulnerability stems from a missing capability check on the liquid_reset_wordpress_before AJAX action. Authenticated attackers with Subscriber-level access or higher can invoke this endpoint to deactivate every plugin installed on the affected site. The issue is categorized as broken access control under CWE-862: Missing Authorization. After the initial disclosure attempt through Envato went unanswered, the developer added a nonce check. The nonce alone does not remediate the flaw because it is exposed to any authenticated user with dashboard access.

Critical Impact
Low-privileged authenticated users can deactivate all plugins on the target WordPress site, disabling security controls and disrupting site functionality.

Affected Products

WordPress themes distributed by LiquidThemes on ThemeForest
WordPress plugins bundled or distributed by LiquidThemes
Sites where any affected LiquidThemes component is active and the liquid_reset_wordpress_before AJAX handler is registered

Discovery Timeline

2025-08-28 - CVE-2025-0951 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0951

Vulnerability Analysis

The flaw resides in the AJAX handler registered for the liquid_reset_wordpress_before action. WordPress exposes AJAX endpoints through wp-admin/admin-ajax.php, and any authenticated user, including Subscribers, can reach handlers registered with wp_ajax_ prefixes. Handlers must independently verify the caller's capability using functions such as current_user_can(). The affected LiquidThemes code omitted this check, allowing any logged-in user to trigger plugin deactivation logic that should be reserved for administrators.

The vendor's follow-up fix added a nonce verification step. Nonces in WordPress protect against cross-site request forgery, not against privilege escalation. Any authenticated user who loads the admin dashboard receives the nonce and can replay it against the endpoint. The authorization gap therefore remains open.

Root Cause

The root cause is a missing authorization check in a privileged AJAX handler. The handler assumes the caller has administrative rights but never validates that assumption through current_user_can('activate_plugins') or an equivalent capability check.

Attack Vector

An attacker registers or compromises a Subscriber-level account on the target site. The attacker retrieves the required nonce from any dashboard page accessible to Subscribers, then issues a POST request to admin-ajax.php with action=liquid_reset_wordpress_before and the harvested nonce. The handler executes plugin deactivation logic, disabling every active plugin including security, backup, and firewall plugins.

No verified public exploit code is available. See the Wordfence advisory for additional technical context.

Detection Methods for CVE-2025-0951

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing the parameter action=liquid_reset_wordpress_before from non-administrator sessions
WordPress activity log entries showing multiple plugins deactivated in rapid succession by a Subscriber or Contributor account
Unexpected loss of protection from security plugins immediately after a low-privileged login event

Detection Strategies

Monitor web server access logs for admin-ajax.php requests referencing the liquid_reset_wordpress_before action and correlate the source user to their role
Alert on any plugin state change originating from accounts below the Administrator role by auditing the active_plugins option in wp_options
Deploy a WordPress security plugin or Web Application Firewall rule that inspects AJAX action names against an allowlist of permitted low-privilege actions

Monitoring Recommendations

Ingest WordPress access logs and PHP error logs into a centralized log platform for correlation across sessions and IP addresses
Track new Subscriber registrations followed shortly by dashboard access and AJAX activity, a common pattern for this class of attack
Review the LiquidThemes vendor page on ThemeForest for patch announcements affecting products in use

How to Mitigate CVE-2025-0951

Immediate Actions Required

Inventory all LiquidThemes themes and plugins in use and identify vulnerable installations
Disable open user registration or restrict the default role to prevent unauthenticated actors from obtaining Subscriber access
Apply a Web Application Firewall rule that blocks requests to admin-ajax.php with action=liquid_reset_wordpress_before from non-administrator sessions

Patch Information

No vendor advisory URL is currently listed in the CVE record. The developer reportedly added a nonce check, but that mitigation is insufficient because the nonce is available to any authenticated dashboard user. Site owners should monitor the LiquidThemes ThemeForest profile and the Wordfence vulnerability entry for a fix that adds a proper capability check.

Workarounds

Remove or deactivate the affected LiquidThemes plugin or theme until a version enforcing current_user_can('activate_plugins') is released
Set define('DISALLOW_FILE_MODS', true); in wp-config.php to reduce the impact of unauthorized plugin state changes in environments that do not require plugin management from the dashboard
Restrict access to /wp-admin/admin-ajax.php at the reverse proxy layer for the specific action string when a patch is unavailable

bash

# Example ModSecurity rule to block the vulnerable AJAX action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,id:1009510,phase:2,deny,status:403,log,\
     msg:'CVE-2025-0951 LiquidThemes plugin deactivation attempt'"
  SecRule ARGS:action "@streq liquid_reset_wordpress_before"