Theme Editor
Monthly
Cross-site request forgery in the Theme Editor WordPress plugin (all versions ≤ 3.1) enables modification of child theme CSS styles by exploiting absent nonce validation on the ms_update AJAX action. An unauthenticated network attacker who social-engineers a logged-in WordPress administrator into loading a crafted page can silently overwrite child theme CSS without any direct interaction with the WordPress backend. No public exploit code or active exploitation has been identified at time of analysis; the mandatory administrator interaction (UI:R in CVSS) is the primary friction limiting opportunistic mass exploitation.
Cross-Site Request Forgery in WordPress Theme Editor plugin versions through 3.2 enables unauthenticated attackers to inject arbitrary code via social engineering, achieving remote code execution with critical scope change impact. The vulnerability requires user interaction but no authentication (CVSS PR:N/UI:R), creating a pathway from CSRF to complete site compromise. EPSS exploitation probability is low (0.01%, 1st percentile), and no public exploit identified at time of analysis.
The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allowing administrators to download arbitrary files on the web. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-site request forgery in the Theme Editor WordPress plugin (all versions ≤ 3.1) enables modification of child theme CSS styles by exploiting absent nonce validation on the ms_update AJAX action. An unauthenticated network attacker who social-engineers a logged-in WordPress administrator into loading a crafted page can silently overwrite child theme CSS without any direct interaction with the WordPress backend. No public exploit code or active exploitation has been identified at time of analysis; the mandatory administrator interaction (UI:R in CVSS) is the primary friction limiting opportunistic mass exploitation.
Cross-Site Request Forgery in WordPress Theme Editor plugin versions through 3.2 enables unauthenticated attackers to inject arbitrary code via social engineering, achieving remote code execution with critical scope change impact. The vulnerability requires user interaction but no authentication (CVSS PR:N/UI:R), creating a pathway from CSRF to complete site compromise. EPSS exploitation probability is low (0.01%, 1st percentile), and no public exploit identified at time of analysis.
The Theme Editor WordPress plugin before 2.6 did not validate the GET file parameter before passing it to the download_file() function, allowing administrators to download arbitrary files on the web. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.