CVE-2025-54736: 
WordPress vulnerability analysis and mitigation

A sensitive data exposure vulnerability was identified in NordicMade's Savoy WordPress theme, tracked as CVE-2025-54736. The vulnerability affects versions through 3.0.8 and allows unauthorized access to retrieve embedded sensitive system information. The issue was discovered by Ananda Dhakal and was publicly disclosed on August 14, 2025 (Patchstack).

The vulnerability is classified as an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). It received a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating that it is network-accessible, requires low attack complexity, and needs no privileges or user interaction to exploit (Patchstack).

The vulnerability could allow malicious actors to view sensitive information that is normally not accessible to regular users. This exposed information could potentially be leveraged to exploit other weaknesses in the system (Patchstack).

The vulnerability has been fixed in version 3.0.9 of the Savoy theme. Users are advised to update to version 3.0.9 or later to remove the vulnerability (Patchstack).