StylemixThemes

The Motors theme, a premium WordPress theme developed by StylemixThemes, was found to have a critical vulnerability (CVE-2025-4322). This flaw allowed threat actors to take over admin accounts and gain full control of the websites using the theme. The issue was due to improper validation of user identities before updating passwords. The developers released a fix, but all versions up to 5.6.68 were affected. The theme, which is used by auto dealers and related services, has been sold over 22,300 times, making it a significant target for cybercriminals.

Source: https://www.techradar.com/pro/security/vulnerability-that-allows-full-admin-takeover-found-in-premium-wordpress-theme

TPRM report: https://scoringcyber.rankiteo.com/company/stylemixthemes

"id": "sty511052325",
"linkid": "stylemixthemes",
"type": "Vulnerability",
"date": "5/2025",
"severity": "100",
"impact": "",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'industry': ['Auto Dealers',
                                     'Classified Listing',
                                     'Auto Rental',
                                     'Boats',
                                     'Repair Services',
                                     'Motorcycle Dealers'],
                        'name': 'Motors Theme Users',
                        'size': '22,300+ users',
                        'type': 'Organization'}],
 'attack_vector': 'Authentication Bypass',
 'date_publicly_disclosed': '2025-05-14',
 'date_resolved': '2025-05-14',
 'description': 'A critical vulnerability in the Motors WordPress theme '
                'allowed threat actors to take over admin accounts, leading to '
                'full website takeover.',
 'impact': {'operational_impact': 'Full website takeover',
            'systems_affected': ['Websites using Motors theme']},
 'initial_access_broker': {'entry_point': 'Motors WordPress Theme',
                           'high_value_targets': 'Admin accounts'},
 'lessons_learned': 'Keep themes and add-ons updated and minimize the use of '
                    'unnecessary add-ons.',
 'motivation': 'Website Takeover',
 'post_incident_analysis': {'corrective_actions': 'Update to the latest '
                                                  'version of Motors theme',
                            'root_causes': 'Improper validation of user '
                                           'identities before updating '
                                           'passwords'},
 'recommendations': 'Update the Motors theme to the latest version.',
 'references': [{'source': 'Wordfence'}, {'source': 'BleepingComputer'}],
 'response': {'remediation_measures': 'Update to the latest version of Motors '
                                      'theme'},
 'title': 'Motors WordPress Theme Vulnerability',
 'type': 'Privilege Escalation',
 'vulnerability_exploited': 'CVE-2025-4322'}