What is the CVSS score of CVE-2026-57655?

CVE-2026-57655 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of Child Theme Wizard are affected by CVE-2026-57655?

The Child Theme Wizard WordPress plugin (versions 1.4 and earlier) contains a Cross-Site Request Forgery vulnerability allowing a remote, unauthenticated attacker to deceive logged-in administrators…

How to fix or mitigate CVE-2026-57655?

24 hours: Identify all WordPress instances running Child Theme Wizard plugin versions 1.4 or earlier; disable the plugin immediately and document the change. 7 days: Audit recent administrator account activity and configuration changes for anomalies; implement enhanced logging of all admin actions and restrict administrative access to essential personnel only. 30 days: Monitor vendor security advisories for patch availability; develop and test a remediation plan including upgrade to a patched version or migration to an alternative plugin solution.

Child Theme Wizard CVE-2026-57655

EUVD-2026-39770 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-26 audit@patchstack.com

GHSA-rfg3-55h8-446c

WordPress CSRF Wordpress Plugin

8.2

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L

vuln.today AI

8.2 HIGH

Remote unauthenticated CSRF (AV:N/PR:N) requires a logged-in admin to interact (UI:R); forged privileged action changes site state across components (S:C, I:H) with minor availability impact and no direct data disclosure.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:46 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions.

AnalysisAI

Cross-Site Request Forgery in the Child Theme Wizard WordPress plugin (versions 1.4 and earlier) lets a remote, unauthenticated attacker trick a logged-in administrator into submitting forged state-changing requests, allowing unauthorized actions on the WordPress site without the victim's consent. The CVSS 3.1 score is 8.2 with a scope-change (S:C) and high integrity impact, reflecting that the forged action can affect resources beyond the vulnerable component. There is no public exploit identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score was supplied.

Technical ContextAI

Child Theme Wizard is a WordPress plugin used to generate and manage child themes. The root cause is CWE-352 (Cross-Site Request Forgery): one or more state-changing actions in the plugin lack a valid anti-CSRF nonce check (WordPress's wp_nonce mechanism) and/or proper request-origin validation. Because WordPress relies on the administrator's authenticated session cookie, a forged request originating from an attacker-controlled page will be processed with the victim admin's privileges. No CPE strings were provided in the input; affected scope is defined by version (<= 1.4) per the Patchstack advisory.

RemediationAI

Update to a fixed release of Child Theme Wizard above version 1.4 once the vendor publishes one; the input data does not specify an exact patched version, so confirm the fixed build directly via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/child-theme-wizard/vulnerability/wordpress-child-theme-wizard-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve) and the WordPress plugin repository before deploying. If no fixed version is available yet, deactivate and remove the plugin to eliminate the attack surface, since CSRF cannot be triggered against an inactive plugin; the trade-off is loss of child-theme management functionality. As compensating controls, deploy a WAF or security plugin (e.g. Patchstack, Wordfence) with virtual-patching/CSRF rules, instruct administrators not to browse untrusted sites or click unsolicited links while logged into wp-admin, and restrict wp-admin access by IP allowlist where feasible to reduce the chance a malicious page can reach an authenticated admin session.