What is the CVSS score of CVE-2026-8423?

CVE-2026-8423 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

JaviBola Custom Theme Test CVE-2026-8423

EUVD-2026-31025 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-05-20 Wordfence

GHSA-2cxv-v4mv-9w27

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:40 vuln.today

DescriptionCVE.org

The JaviBola Custom Theme Test plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on the options page. This makes it possible for unauthenticated attackers to change the site's active theme by modifying the jbct_theme option via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

Cross-Site Request Forgery in the JaviBola Custom Theme Test WordPress plugin (all versions through 2.0.5) enables unauthenticated remote attackers to silently replace the site's active theme by forging a request that modifies the jbct_theme option. Exploitation requires social-engineering a logged-in site administrator into clicking a crafted link - the CVSS UI:R requirement reflects this dependency. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Technical ContextAI

WordPress plugins are expected to protect state-changing admin actions using nonce tokens, validated via wp_verify_nonce() or check_admin_referer(), which cryptographically bind requests to a specific user session and timestamp. The affected plugin's options page handler - visible in the WordPress plugin repository at javibola-custom-theme.php lines 40, 41, and 54 - omits or incorrectly implements this check, leaving the jbct_theme option writable by any cross-origin request that the administrator's browser sends. CWE-352 (Cross-Site Request Forgery) is the root-cause class: the server cannot distinguish a legitimate admin form submission from a forged one constructed by a third party. The CPE cpe:2.3:a:javibola:javibola_custom_theme_test:*:*:*:*:*:*:*:* confirms the vulnerability spans the entire published version history through 2.0.5.

RemediationAI

No vendor-released patched version has been identified in the available data - the CPE wildcard covering all versions through 2.0.5 and the absence of any fix-version reference in the provided intelligence means patch availability cannot be confirmed. Administrators should immediately check the WordPress plugin repository for a release newer than 2.0.5 and upgrade if available. If no patched version exists or the plugin is not actively needed, the safest compensating control is to deactivate and remove the JaviBola Custom Theme Test plugin entirely, which eliminates the attack surface with no trade-off for sites that do not depend on the plugin's functionality. If the plugin must remain active, enforce strict role-based access control to limit which accounts hold administrator privileges, reducing the pool of viable social-engineering targets. Additionally, requiring multi-factor authentication for admin logins reduces session hijack risk but does not prevent CSRF if a session cookie is already live during an attack. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/68a8a277-2ea6-4d75-b8cd-4d20eb17b3aa for patch release updates.