CVE-2025-9331: 
WordPress vulnerability analysis and mitigation

The Spacious theme for WordPress contains a vulnerability (CVE-2025-9331) discovered on August 22, 2025, affecting versions up to and including 1.9.11. The vulnerability stems from a missing capability check on the 'welcomenoticeimport_handler' function, which allows authenticated attackers with Subscriber-level access or higher to import demo data into the site (NVD Database).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The issue is classified as CWE-862 (Missing Authorization), indicating a fundamental security control problem where authorization checks are not properly implemented (NVD Database).

The vulnerability allows authenticated users with Subscriber-level privileges to perform unauthorized data imports into the WordPress site. This could potentially lead to unauthorized modification of site content and configuration (NVD Database).

The vulnerability has been patched in version 1.9.12 of the Spacious theme. Site administrators are strongly advised to update to this version or later to address the security issue (WordPress Themes).