Theme Editor CVE-2025-14469

Exploitation requires two concrete conditions: the target WordPress site must have the Theme Editor plugin (≤ 3.1) installed and activated, and a user holding the WordPress Administrator role must be tricked into loading an attacker-controlled page while their authenticated session is active - this is the User Interaction Required (UI:R) constraint in the CVSS vector. The AJAX action ms_update must be reachable, which is true in all standard plugin installations with no additional configuration needed. Exploitation is limited by: the mandatory administrator action (the attack silently fails if no admin loads the malicious page), the impact scope being restricted to CSS overwrite of child themes only with no code execution path, no data read capability, and no availability impact, and the requirement that the administrator's session cookie be valid and unexpired at the moment the forged request fires. No non-default configuration, specific platform variant, or authenticated attacker credential is required beyond the victim's admin session.

The CVSS 4.3 Medium score is calibrated appropriately for this vulnerability. The AV:N/AC:L/PR:N combination makes the attack remotely triggerable with no attacker-side authentication or complex preconditions, but UI:R - mandatory administrator interaction - introduces meaningful friction that prevents automated or opportunistic exploitation. Impact is bounded to integrity of child theme CSS (I:L), with no confidentiality exposure or availability disruption. No EPSS data was provided in the intelligence, and neither KEV status nor POC availability was indicated, supporting an assessment of no confirmed active exploitation. Real-world risk is moderate rather than critical: successful exploitation modifies visual presentation rather than executing code or exfiltrating data, which limits the blast radius. However, CSS injection over a site's theme is not entirely benign - an attacker could inject malicious overlay styles to facilitate UI-redressing or credential-harvesting phishing within the legitimate domain, which marginally elevates practical impact beyond what the raw CVSS integer suggests. The mandatory admin interaction remains the single most important limiting factor for defender prioritization.

An attacker discovers a WordPress site running Theme Editor ≤ 3.1, then constructs a malicious HTML page containing a hidden auto-submitting form that POSTs to the target's wp-admin/admin-ajax.php with action=ms_update and attacker-chosen CSS content, such as styles that overlay a fake login prompt on top of the legitimate site. The attacker delivers the URL to a WordPress administrator via phishing email or a compromised comment on a third-party site; when the administrator loads the attacker's page while their WordPress session is active, the browser automatically attaches their session cookies to the forged request, and the plugin processes it without any nonce check, silently replacing child theme CSS. No public POC code has been identified, though this follows a well-documented CSRF pattern against WordPress AJAX endpoints that is trivially reproducible by an attacker with basic web knowledge.