CVE-2025-10915

Critical · 9.8

CVSS

9.8

EPSS

0.3%

Published

Jan 13, 2026

CISA due date

—

The record

The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check.

Ecosystem	Package	Introduced	Fixed