CVE-2025-54002: 
WordPress vulnerability analysis and mitigation

CVE-2025-54002 is a Missing Authorization (Broken Access Control) vulnerability in the Jthemes xSmart WordPress theme that allows authenticated low-privilege attackers to exploit incorrectly configured access control security levels. It affects xSmart versions up to and including 1.2.9.4. The vulnerability was reported on September 8, 2025, by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) and published on January 22, 2026. The CNA (Patchstack) assigned a CVSS v3.1 base score of 6.5 (Medium), while an earlier CISA-ADP assessment had scored it 8.8 (High) before being revised (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the xSmart theme fails to perform adequate authorization checks before executing certain privileged actions. An authenticated attacker with Subscriber-level access can invoke functionality that should be restricted to higher-privileged roles, bypassing role-based access controls. The attack vector is network-based, requires low privileges, no user interaction, and low attack complexity, making it straightforward to exploit once an attacker has any authenticated session on the WordPress site (Patchstack).

Successful exploitation allows an authenticated low-privilege user (e.g., a Subscriber) to perform actions restricted to higher-privileged roles, primarily affecting integrity. According to the Patchstack CNA score, the primary impact is high integrity loss (unauthorized modification of data or settings), with no direct confidentiality or availability impact assessed at the CNA level. In a WordPress context, this could allow an attacker to modify site content, settings, or other data they should not have access to, potentially leading to site defacement or further compromise (Patchstack).

There is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.017%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that broken access control vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the xSmart theme version 1.2.9.4 or earlier, using tools like WPScan or by inspecting theme metadata in page source.
2. Obtain low-privilege access: Register or obtain a Subscriber-level account on the target WordPress site (many sites allow open registration).
3. Identify unprotected endpoints: Enumerate WordPress AJAX actions or REST API endpoints exposed by the xSmart theme that lack proper capability checks (e.g., missing current_user_can() validation).
4. Send crafted request: Issue an authenticated HTTP request (with valid nonce/session cookie) to the vulnerable endpoint, invoking a privileged action such as modifying theme settings or site content.
5. Achieve unauthorized action: The server processes the request without verifying the user's role, allowing the attacker to perform the restricted action — such as modifying site data or configuration (Patchstack).

• Logs: WordPress access logs showing POST requests to wp-admin/admin-ajax.php or REST API endpoints from low-privilege user accounts performing administrative actions; unexpected modifications to theme settings or site content attributed to Subscriber-level users.
• File System: Unexpected changes to WordPress options or theme configuration files not initiated by an administrator.
• Application: WordPress audit logs (if enabled via a plugin) showing privilege escalation events or unauthorized settings changes by non-admin users.

No official patch from the theme developer (Jthemes) is currently available for xSmart. Patchstack has issued a virtual patch (mitigation rule) for Patchstack users to block exploitation attempts until an official fix is released. Site administrators should consider deactivating the xSmart theme if a patched version is unavailable, restricting user registration to prevent untrusted Subscriber accounts, and auditing existing user roles. Monitoring access logs for suspicious activity from low-privilege accounts is also recommended (Patchstack).

The vulnerability was discovered and reported by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity and disclosed through Patchstack's coordinated vulnerability disclosure program. Patchstack classified it as medium priority and noted it is the type of vulnerability commonly leveraged in mass WordPress exploit campaigns. No significant broader media coverage or notable social media discussion has been identified (Patchstack).