CVE-2025-9266
Received Received - Intake

Accelerate Theme Missing Capability Check Leads to Plugin Installation

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: Wordfence

Description
The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueue_scripts() function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the ThemeGrill Demo Importer plugin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2025-9266
EUVD
EUVD-2025-210641

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
themegrill accelerate to 1.5.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Accelerate WordPress theme has a flaw in the enqueue_scripts() function where a missing capability check allows authenticated users with Subscriber access or higher to install and activate the ThemeGrill Demo Importer plugin without proper authorization.

Detection Guidance

Check WordPress installations for the Accelerate theme version 1.5.3 or lower. Look for unauthorized activation of the ThemeGrill Demo Importer plugin by users with Subscriber-level access or higher.

Impact Analysis

An attacker could exploit this to install unwanted plugins on your WordPress site, potentially leading to further security risks, data breaches, or unauthorized modifications to your website's functionality.

Compliance Impact

This vulnerability allows authenticated attackers with Subscriber-level access to install and activate plugins. This could lead to unauthorized data access, modification, or exfiltration, which may violate GDPR or HIPAA compliance if sensitive data is involved.

Mitigation Strategies

Update the Accelerate theme to the latest version. Remove any unauthorized plugin installations, particularly ThemeGrill Demo Importer. Review user roles and permissions to ensure only necessary access is granted.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-9266. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart