CVE-2025-8999: Sydney <= 2.56 - Missing Authorization to Authenticated (Subscriber+) Limited Theme Options Update
Vulnerability summary
CVE-2025-8999 is a medium (CVSS 5.3) Missing Authorization vulnerability in athemes sydney. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19.5% of scored vulnerabilities. Fixed in 2.57.
Timeline
- 17-09-2025PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The Sydney theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'activate_modules' function in all versions up to, and including, 2.56. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate or deactivate various theme modules.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- wordfenceSource5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.28%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.28% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Athemes1 product
- sydney≤ 2.56
Wordpress1 product
- sydney≤ 2.56 (fixed in 2.57)
2 vendors · 2 products