The Plugin is vulnerable to a Cross‑Site Request Forgery flaw caused by missing nonce validation when processing form submissions. An unauthenticated attacker can craft a forged request that, if a site administrator unknowingly submits it—such as by clicking a link—triggers arbitrary file downloads or other malicious operations. The weakness is identified as CWE-352. The impact is that an attacker can coerce an administrator into performing actions the attacker wants, potentially leading to unauthorized file access or further exploitation depending on the victim’s role and privileges.

The affected system is the WordPress Theme Importer plugin developed by steve‑forster. All versions up to and including 1.0 are vulnerable. Sites running any of these versions are at risk until the plugin is updated or removed.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of < 1% signals a very low likelihood of widespread exploitation at this time, and the vulnerability is not present in the CISA KEV list. However, because the attack requires the target administrator to perform an action that may not be obvious, the risk remains real for active sites with the plugin installed. Exploitation is possible when an attacker can deliver a malicious link or form to an admin user.