CVE-2025-1681: Thememakers Car Dealer Automotive WordPress Theme – Responsive

Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days.

The Cardealer theme for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check and missing filename sanitization on the demo theme scheme AJAX functions in versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to change or delete arbitrary css and js files.

Affected products

• Thememakers Car Dealer Automotive WordPress Theme – Responsive: up to and including 1.6.4

Published 2025-02-28. Last modified 2026-06-17.