The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Cardealer theme for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check and missing filename sanitization on the demo theme scheme AJAX functions in versions up to, and including, 1.6.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to change or delete arbitrary css and js files.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Cardealer Theme | — | Update cardealer theme to version 1.6.5, or a newer patched version | Dec 8, 2025 | Feb 27, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub