What is the CVSS score of CVE-2026-22342?

CVE-2026-22342 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WordPress Dating Theme are affected by CVE-2026-22342?

PremiumPress WordPress Dating Theme versions 11.2.0 and earlier contain a cross-site request forgery vulnerability enabling account takeover of authenticated users, with a documented attack path…

How to fix or mitigate CVE-2026-22342?

Within 24 hours: Inventory all WordPress installations running PremiumPress Dating Theme version 11.2.0 or earlier; flag for priority remediation. Within 7 days: Deploy Web Application Firewall rules to block cross-site requests from untrusted origins, enforce nonce-based CSRF token validation on all state-changing operations, and apply Content Security Policy headers with frame-ancestors directive. Within 30 days: Monitor Patchstack and vendor advisories for patch release; if no patch issued, evaluate alternative dating theme solutions and plan migration to patched alternatives.

WordPress Dating Theme CVE-2026-22342

EUVD-2026-37661 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-17 Patchstack

WordPress CSRF Wordpress Dating Theme Wordpress Theme

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Classic CSRF: attacker is network-unauthenticated (PR:N) but needs victim to click (UI:R); account takeover yields full C/I/A impact within the same site (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:29 vuln.today

CVE Published

Jun 17, 2026 - 09:50 cve.org

HIGH 8.8

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in WordPress Dating Theme <= 11.2.0 versions.

AnalysisAI

Cross-Site Request Forgery in PremiumPress WordPress Dating Theme versions 11.2.0 and earlier allows remote attackers to coerce authenticated victims into performing unintended state-changing actions, with Patchstack documenting an account takeover path. The CVSS 8.8 rating reflects high impact on confidentiality, integrity, and availability when a targeted user is tricked into visiting attacker-controlled content. No public exploit identified at time of analysis and the theme has not been listed in CISA KEV.

Technical ContextAI

The vulnerability is rooted in CWE-352 (Cross-Site Request Forgery), where the WordPress Dating Theme accepts authenticated state-changing requests without validating an anti-CSRF token (such as WordPress's wp_nonce mechanism) or strictly verifying the request origin/referer. The affected product is PremiumPress WordPress Dating Theme (CPE cpe:2.3:a:premiumpress_limited.:wordpress_dating_theme), a commercial WordPress theme that ships its own account, profile, and membership management endpoints. Because these endpoints execute under the privileges of the logged-in user's browser session cookie, any cross-origin form or image submission can drive them, and per the Patchstack advisory the chain reaches full account takeover - likely by changing the victim's email/password through a profile-update handler that lacks nonce verification.

RemediationAI

Patch available per vendor advisory - upgrade the WordPress Dating Theme to a release later than 11.2.0 as soon as PremiumPress publishes a fixed build, tracked via the Patchstack entry at https://patchstack.com/database/wordpress/theme/da10/vulnerability/wordpress-wordpress-dating-theme-theme-11-2-0-cross-site-request-forgery-csrf-to-account-takeover-vulnerability (no exact fixed version was provided in the input data, so confirm the patched release number directly with PremiumPress before relying on it). Until the patched version is deployed, compensating controls include installing a virtual-patching WAF such as Patchstack or Wordfence with CSRF rules enabled for theme endpoints, enforcing SameSite=Lax or Strict on the WordPress auth cookies via a security plugin (side effect: may break cross-site embeds and some OAuth flows), and requiring administrators to log out of the dating site before browsing untrusted content. Disabling self-service profile editing for privileged roles, and requiring re-authentication for email/password changes via a 2FA plugin, narrows the account-takeover blast radius at the cost of user friction.