Advanced Twenty Seventeen
Monthly
Missing authorization in the Advanced Twenty Seventeen WordPress plugin through 1.3.1 lets any authenticated user, including a subscriber, create and activate the plugin's bundled child theme site-wide, and lets an attacker trigger the same theme switch via CSRF against any logged-in user up to an administrator. The flaw affects site integrity and availability only, with no confidentiality impact; no KEV entry is present in the supplied intelligence, a public PoC reference exists but is not verified as working exploit code, and EPSS is 0.13% (2nd percentile).
Missing authorization in the Advanced Twenty Seventeen WordPress plugin through 1.3.1 lets any authenticated user, including a subscriber, create and activate the plugin's bundled child theme site-wide, and lets an attacker trigger the same theme switch via CSRF against any logged-in user up to an administrator. The flaw affects site integrity and availability only, with no confidentiality impact; no KEV entry is present in the supplied intelligence, a public PoC reference exists but is not verified as working exploit code, and EPSS is 0.13% (2nd percentile).