CVE-2025-9266: Accelerate <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation
The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueuescripts() function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install and activate the ThemeGrill Demo Importer plugin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Accelerate themeto a version that resolves this vulnerability.Fixed in 1.5.3 - Configuration
Update the Accelerate theme to include a capability check on the enqueue_scripts() function so Subscriber-level (and above) authenticated users cannot install and activate the ThemeGrill Demo Importer plugin via the vulnerability present in versions up to and including 1.5.3.
WordPress Accelerate theme enqueue_scripts() capability check = Require sufficient capability before enqueuing scripts
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9266?
The severity of CVE-2025-9266 is rated as medium with a score of 4.3.
How do I fix CVE-2025-9266?
To fix CVE-2025-9266, update the Accelerate theme to version 1.5.4 or later.
Who is affected by CVE-2025-9266?
CVE-2025-9266 affects authenticated users with Subscriber-level access and above.
What kind of attack is CVE-2025-9266 related to?
CVE-2025-9266 is related to unauthorized modification of data due to a missing capability check.
What specific function is vulnerable in CVE-2025-9266?
The enqueue_scripts() function is vulnerable in CVE-2025-9266 due to missing authorization checks.