Education Zone Vulnerabilities

The Education Zone theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.3.8. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.3.8

Fixed in:

1.3.9

Disclosed:

Mar 17, 2026

CVE-2026-25009 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Education Zone allows Cross Site Request Forgery.This issue affects Education Zone: from n/a through 1.3.4.

Affected:

up to 1.3.5

Fixed in:

1.3.5

Disclosed:

Jan 2, 2025

CVE-2024-37103 on NVD →

The Education Zone theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.4. This is due to missing or incorrect nonce validation on the education_zone_update_admin_notice() function. This makes it possible for unauthenticated attackers to dismiss notices via a forged requ...

CVSS:

4.3

Affected:

up to 1.3.4

Fixed in:

1.3.5

Disclosed:

Jun 20, 2024

CVE-2024-37103 on NVD →