CVE-2025-58210 is a medium severity (CVSS 5.3) missing authorization flaw in Makeaholic, a WordPress theme from ThemeMove. Versions through 1.8.5 do not check that callers may perform an action. The record names no fixed version, so check the vendor changelog and Patchstack.
What's affected
Makeaholic versions through 1.8.5, per the record and the Patchstack entry.
The record does not name a fixed version. Check the Patchstack page and the theme vendor's changelog for the current patched release before you rely on an update.
Both active and inactive installs matter, since the theme files remain on disk.
How to check if you're exposed
Use WP-CLI on each WordPress site, or look at Appearance, Themes in the dashboard.
wp theme list --fields=name,status,version
wp theme get makeaholic --fields=name,version,status
Look at the version column for Makeaholic. The record covers versions through 1.8.5. Check inactive installs too, because a theme that is installed but not active can still have its files reachable on the server.
What to do now
- Run wp theme list on every site and find Makeaholic.
- Update to the vendor's latest release, and confirm in its changelog or on the Patchstack page that it addresses this issue.
- If the theme is not in use, delete it. If it is in use and no patched release exists, plan a switch to a maintained theme.
- Review web server logs for unusual requests to theme files, and keep a recent backup of the site and database.
- Review your logs for requests to the affected area from accounts or addresses that do not normally use it.
- Test with a low privilege account after patching to confirm the restriction now holds.
Why it matters
Missing authorization means the code performs an action without asking whether the caller is allowed to. The record describes it as exploiting incorrectly configured access control security levels. The CVSS vector shows no login needed and a low integrity impact, so an outsider could change something limited.
A medium score is not a reason to ignore it. Low impact flaws often become useful when combined with other weaknesses, and unpatched themes are scanned for at scale.
The record classifies the weakness as CWE-862 (Missing Authorization).
Access control bugs are quiet. Nothing crashes and no error appears, because the application does exactly what the request asked. The flaw is that the server never asked whether the caller was allowed to ask.
The durable fix is to check authorization on the server for every action, tied to the identity of the caller, and never to rely on what the browser interface chooses to show. Reviewing a few sensitive endpoints with a second account of lower privilege is a cheap way to find this class of problem before someone else does.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Is there a fixed version of Makeaholic?
The record lists versions through 1.8.5 as affected and gives no fixed version. Check the Patchstack page and the vendor changelog.
Does deleting an inactive Makeaholic install help?
Yes. An inactive theme still has files on disk, so removing it removes the exposure.
Sources
Last reviewed: 18 October 2026.
