CVE-2025-8669

The Customify theme for WordPress is vulnerable to Cross-Site Request Forgery in version 0.4.11. This is due to missing or incorrect nonce validation on the reset_customize_section function. This makes it possible for unauthenticated attackers to reset theme customization settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://research.cleantalk.org/cve-2025-8669/
• https://themes.trac.wordpress.org/browser/customify/0.4.11/inc/customizer/class-customizer.php#L55
• https://themes.trac.wordpress.org/changeset/291160/customify/0.4.12/inc/customizer/class-customizer.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a3425d78-1e24-4224-bfdc-a3e11735384f?source=cve
• https://research.cleantalk.org/cve-2025-8669/

Published

Oct 3, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-8663Insertion of Sensitive Information into Log File vulnerabili…6.5
• CVE-2025-8664Improper Neutralization of Input During Web Page Generation …6.3
• CVE-2025-8665A vulnerability, which was classified as critical, has been …6.3
• CVE-2025-8666The Testimonial Carousel For Elementor plugin for WordPress …6.4
• CVE-2025-8667A vulnerability, which was classified as critical, was found…6.3
• CVE-2025-8668Improper Neutralization of Input During Web Page Generation …9.4
• CVE-2025-8671A mismatch caused by client-triggered server-sent stream res…7.5
• CVE-2025-8672MacOS version of GIMP bundles a Python interpreter that inhe…7.8
• CVE-2025-8675Server-Side Request Forgery (SSRF) vulnerability in Drupal A…8.8
• CVE-2025-8676The B Slider- Gutenberg Slider Block for WP plugin for WordP…4.3
• CVE-2025-8677Querying for records within a specially crafted zone contain…7.5
• CVE-2025-8678The WP Crontrol plugin for WordPress is vulnerable to blind …5.9