CVE-2025-11164 Mavix Education <= 1.0 - Missing Authorization to Authenticated (Subscriber+) 'Creativ Demo Importer' Plugin Activation

🗓️ 13 Dec 2025 04:31:30Reported by WordfenceType

Mavix Education up to version 1.0 lacks capability check on mavix_education_activate_plugin, enabling Subscriber+ to activate Creativ Demo Importer.

Reporter	Title	Published	Views	Family All 10
CNNVD	WordPress plugin Mavix Education 安全漏洞	13 Dec 202500:00	–	cnnvd
CVE	CVE-2025-11164	13 Dec 202504:31	–	cve
EUVD	EUVD-2025-203208	13 Dec 202518:30	–	euvd
NVD	CVE-2025-11164	13 Dec 202516:16	–	nvd
Patchstack	WordPress Mavix Education plugin <= 1.0 - Missing Authorization to Authenticated (Subscriber+) 'Creativ Demo Importer' Plugin Activation vulnerability	12 Dec 202523:06	–	patchstack
Patchstack	WordPress Mavix Education plugin <= 1.0 - Missing Authorization to Authenticated (Subscriber+) 'Creativ Demo Importer' Plugin Activation vulnerability	12 Dec 202523:06	–	patchstack
Positive Technologies	PT-2025-51051	13 Dec 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-11164	14 Dec 202505:03	–	redhatcve
Vulnrichment	CVE-2025-11164 Mavix Education <= 1.0 - Missing Authorization to Authenticated (Subscriber+) 'Creativ Demo Importer' Plugin Activation	13 Dec 202504:31	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (December 8, 2025 to December 14, 2025)	19 Dec 202517:57	–	wordfence

[
  {
    "vendor": "creativthemes",
    "product": "Mavix Education",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/a8e57528-010f-4ec6-917b-4cd8c3fdbd58
themes	www.themes.trac.wordpress.org/changeset

08 Apr 2026 17:14Current

CVSS 3.14.3

EPSS0.00158

CWE-862