EUVD-2025-210579
GHSA-5f44-9hfv-q32p
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-reachable, no attacker privileges needed, but mandatory admin UI:R interaction; impact limited to child theme CSS integrity only.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the ms_update AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
AnalysisAI
Cross-site request forgery in the Theme Editor WordPress plugin (all versions ≤ 3.1) enables modification of child theme CSS styles by exploiting absent nonce validation on the ms_update AJAX action. An unauthenticated network attacker who social-engineers a logged-in WordPress administrator into loading a crafted page can silently overwrite child theme CSS without any direct interaction with the WordPress backend. No public exploit code or active exploitation has been identified at time of analysis; the mandatory administrator interaction (UI:R in CVSS) is the primary friction limiting opportunistic mass exploitation.
Technical ContextAI
The Theme Editor plugin (CPE: cpe:2.3:a:mndpsingh287:theme_editor:*:*:*:*:*:*:*:*) is a WordPress plugin enabling administrators to edit theme CSS and files from the dashboard. The vulnerable handler, ms_update, is an AJAX action registered in ms_theme_editor_controller.php (lines 13 and 60 per the WordPress plugin Trac source). WordPress AJAX endpoints rely on nonce tokens - short-lived cryptographic values tied to the authenticated session - to verify request legitimacy and prevent cross-origin abuse. The absence of nonce validation (CWE-352: Cross-Site Request Forgery) means any HTTP POST that triggers the ms_update action will be processed if the victim's authenticated session cookie is present, which browsers attach automatically to same-origin and certain cross-origin requests. The root cause class is a classic CSRF: no origin verification, no token check, reliance solely on session state.
RemediationAI
Update the Theme Editor plugin to a version beyond 3.1 that includes nonce validation on the ms_update AJAX handler; verify the available release at https://wordpress.org/plugins/theme-editor/#developers. No explicit patched version number is confirmed in the available intelligence - check the changelog for a release that addresses CSRF in the ms_update action. If no patched version is available or upgrade is not immediately feasible, the most effective compensating control is to deactivate and remove the Theme Editor plugin and use an alternative CSS editing method such as the native WordPress Customizer (which has its own nonce handling). As a secondary control, restrict wp-admin access by IP allowlist at the web server or WAF layer, reducing the attack surface to sessions originating from trusted networks only - note this may impact legitimate remote administration workflows. A Web Application Firewall rule blocking cross-origin POST requests to admin-ajax.php with action=ms_update can also mitigate this specific vector without disabling the plugin, though WAF rule accuracy should be validated in a staging environment first.
More in Theme Editor
View allCross-Site Request Forgery in WordPress Theme Editor plugin versions through 3.2 enables unauthenticated attackers to in
The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_f
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today