Theme Editor CVE-2026-39640

The victim must be logged into WordPress with Theme Editor plugin (version ≤3.2) and click a link or visit a page crafted by the attacker. Attacker is an unauthenticated remote user.

Despite the critical CVSS base score of 9.6, real-world exploitation risk is moderate. The CVSS vector reveals required user interaction (UI:R) as a key barrier-an authenticated administrator must be social-engineered into triggering the malicious request. The EPSS score of 0.01% (1st percentile) indicates researchers and attackers currently assess this as low probability for widespread exploitation, likely due to the targeting precision required (must reach WordPress admins of sites running this specific plugin). No public exploit identified at time of analysis and no CISA KEV listing confirms this is not being actively exploited at scale. However, the scope change (S:C) and complete confidentiality/integrity/availability impact (C:H/I:H/A:H) mean successful exploitation results in full site compromise and potential server takeover. The no-privileges-required rating (PR:N) is technically accurate-the HTTP request itself is unauthenticated-but misleading without context: the victim admin must already be authenticated to WordPress when the CSRF payload executes. This is a high-severity issue for sites using Theme Editor 3.2 or earlier, but requires targeted attack effort rather than opportunistic mass exploitation.

An attacker identifies a WordPress site running Theme Editor 3.2, then crafts a malicious webpage containing hidden forms that POST code injection payloads to the plugin's unprotected theme editing endpoints. The attacker sends a phishing email to the site administrator with a pretext to visit the malicious page while logged into WordPress. When the admin visits, their browser automatically submits the CSRF payload, injecting PHP backdoor code into the active theme's functions.php file, granting the attacker persistent remote code execution and full control over the WordPress installation and underlying server.