CVE-2026-39640
A critical Cross-Site Request Forgery (CSRF) flaw in the Theme Editor plugin (versions up to 3.2) could allow an attacker to trick a logged-in user into executing arbitrary code. The vulnerability carries a CVSS v3.1 base score of 9.6, reflecting its high impact on confidentiality, integrity, and availability. No public exploit or known active exploitation has been reported.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users of the Theme Editor plugin running version 3.2 or earlier.
Real-world impact
If exploited, an attacker could perform actions on behalf of the victim, potentially leading to full compromise of the affected site.
Why this severity
The CVSS score of 9.6 (Critical) is driven by the attack being network‑based, low complexity, requiring no privileges, and needing only user interaction, while impacting confidentiality, integrity, and availability at high levels.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Apr 8, 2026 · Apr 8, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.