Rt Theme 18 Extensions CVE-2026-39710

This vulnerability presents a moderate real-world risk despite its low CVSS score and minimal EPSS exploitation probability. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network-accessible attack surface with low complexity and user interaction requirement; the partial integrity and availability impact (I:L/A:L) reflects limited scope-likely affecting plugin-specific functionality rather than full system compromise. SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) reinforces that exploitation requires manual crafting and user engagement, ruling out large-scale automated attacks. However, CSRF vulnerabilities in WordPress plugins are commonly exploited in targeted attacks against site administrators, and the absence of exploitability does not eliminate motivation for attackers targeting specific installations. The 0.01% EPSS score correctly reflects low likelihood of widespread weaponization but should not be misinterpreted as low severity in a targeted threat model. Organizations running this plugin in sensitive WordPress environments (e.g., multi-author blogs, content management systems) should prioritize patching despite the low EPSS signal.

An attacker crafts a webpage embedding a hidden form or image request targeting the vulnerable plugin's administrative action endpoint (e.g., /wp-admin/admin-ajax.php with a stmcan RT-Theme function). The attacker tricks a logged-in WordPress administrator into visiting the malicious page (via email, social engineering, or advertisement injection). The browser automatically includes the administrator's authentication cookies, and the hidden request executes unauthorized actions within the plugin's scope-such as modifying theme settings, deleting content, or altering plugin configuration-without the administrator's knowledge or consent. No exploit code is publicly available, and exploitation remains manual and targeted rather than automated or widespread.