CVE-2025-8891: OceanWP <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation

Q: What is the severity of CVE-2025-8891?

CVE-2025-8891 has a medium severity level due to its potential for exploiting Cross-Site Request Forgery vulnerabilities.

Q: How do I fix CVE-2025-8891?

To fix CVE-2025-8891, update the OceanWP theme to version 4.1.2 or later.

Q: What software versions are affected by CVE-2025-8891?

CVE-2025-8891 affects OceanWP theme versions 4.0.9 to 4.1.1.

Q: What type of vulnerability is CVE-2025-8891?

CVE-2025-8891 is a Cross-Site Request Forgery (CSRF) vulnerability.

Q: Who can exploit CVE-2025-8891?

Unauthenticated attackers can exploit CVE-2025-8891 due to the lack of proper nonce validation.

Published Aug 13, 2025

Updated

The OceanWP theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.0.9 to 4.1.1. This is due to missing or incorrect nonce validation on the oceanwpnoticebuttonclick() function. This makes it possible for unauthenticated attackers to install the Ocean Extra plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected Software

2 affected components

Oceanwp OceanWP>=4.0.9<=4.1.1

Oceanwp OceanWP WordPress>=4.0.9<=4.1.1

Remediation

Patch Available

https://themes.trac.wordpress.org/changeset/283264/oceanwp/4.1.2/inc/activation-notice/api.php

Event History

Aug 13, 2025

CVE Published

via MITRE·03:42 AM

Data Sourced

via MITRE·03:42 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:16 AM

RemedyDescriptionSeverityWeaknessAffected Software

Feb 20, 57937

Event

via FIRST·09:13 PM

Frequently Asked Questions

What is the severity of CVE-2025-8891?

CVE-2025-8891 has a medium severity level due to its potential for exploiting Cross-Site Request Forgery vulnerabilities.

How do I fix CVE-2025-8891?