Advanced Twenty Seventeen CVE-2026-107887

Direct exploitation requires only an authenticated session of any role - the description explicitly names a subscriber - because the theme create-and-activate action performs no capability or nonce check; in practice this presupposes the site allows self-registration or that the attacker already holds some low-privileged account. The second, CSRF-based path requires no attacker account but instead depends on tricking an already-logged-in user (up to an administrator) into loading an attacker-controlled page that submits the forged request, so it is gated by victim interaction and an active authenticated session. Exploitation is bounded to sites running Advanced Twenty Seventeen through 1.3.1; impact is limited to switching/activating the bundled child theme (integrity and availability of the live site), with no confidentiality exposure.

This is a moderate-severity WordPress plugin flaw (CWE-862, missing authorization) with signals that converge on low real-world priority. The input CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L describes a network-reachable, low-complexity issue requiring only low privileges (PR:L, i.e. authenticated) and no user interaction, limited to integrity and availability impact (C:N/I:L/A:L) with no confidentiality loss - consistent with an attacker who can switch the site's active theme but not read data. EPSS is very low at 0.13% (2nd percentile), and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation. A public PoC reference exists (WPScan) but it is not verified as working exploit code, so POC availability must not be read as active exploitation. The vuln.today decision label is 'this_month', not act_now/emergency, which aligns with the low EPSS and absence of KEV. One tension worth noting: the primary exploitation path (an authenticated subscriber switching the theme) is PR:L per the vector, but the description also stresses a CSRF path that can be fired against any logged-in user including an administrator - CSRF realistically requires victim user interaction (visiting a crafted page), which the UI:N vector does not capture for that path. Net: a real but low-urgency bug, driven by severity-of-mechanism rather than widespread-exploitation signals.

A low-privileged authenticated user (for example a subscriber on a site with open registration) sends the plugin's unprotected action request and, because no capability or nonce check is enforced, creates and activates the bundled child theme site-wide, altering the live site for all visitors. Alternatively, an attacker lures a logged-in administrator to a malicious page that auto-submits the same request via CSRF, achieving the theme switch in the admin's session. A public PoC reference exists but is not verified as working exploit code.