EUVD-2025-32542Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered CSRF requiring no attacker privileges but mandatory authenticated admin interaction; impact is limited to low-severity integrity loss via settings reset with no confidentiality or availability consequence.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Customify theme for WordPress is vulnerable to Cross-Site Request Forgery in version 0.4.11. This is due to missing or incorrect nonce validation on the reset_customize_section function. This makes it possible for unauthenticated attackers to reset theme customization settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
Cross-Site Request Forgery in the Customify WordPress theme version 0.4.11 allows unauthenticated remote attackers to reset a site's theme customization settings by tricking an authenticated administrator into clicking a malicious link. The flaw is rooted in missing nonce validation on the reset_customize_section function in inc/customizer/class-customizer.php. No active exploitation has been reported (not in CISA KEV), and an EPSS score of 0.01% (1st percentile) confirms negligible real-world exploitation probability, making this a low-urgency but patchable integrity issue.
Technical ContextAI
Customify is a WordPress theme that exposes theme customization functionality through WordPress's Customizer API. The vulnerable code resides in inc/customizer/class-customizer.php at line 55, where the reset_customize_section function processes requests without verifying a WordPress nonce - the platform's standard CSRF protection mechanism. WordPress nonces are time-limited, user-session-bound cryptographic tokens that authenticate that a form submission or action originated from a legitimate, intentional user action on the same site. CWE-352 (Cross-Site Request Forgery) describes this root cause class: the server trusts the authentication cookie carried by the browser but cannot distinguish a legitimate admin action from a forged cross-origin request. Absent nonce validation, any page loaded in the admin's browser can silently trigger theme-reset actions against the WordPress installation.
RemediationAI
Upgrade to Customify version 0.4.12 or later, which introduces proper nonce validation in the reset_customize_section function as confirmed by the WordPress Themes Trac changeset (https://themes.trac.wordpress.org/changeset/291160/customify/0.4.12/inc/customizer/class-customizer.php). The Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/a3425d78-1e24-4224-bfdc-a3e11735384f) provides additional context. As a compensating control prior to patching, administrators should avoid clicking links from untrusted sources while authenticated to WordPress, and consider deploying a WAF rule set (e.g., Wordfence plugin or a network-layer WAF) with CSRF-detection capabilities. These controls reduce but do not eliminate risk, and patching to 0.4.12 remains the definitive fix.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today