The Simple Theme Changer plugin for WordPress lacks proper nonce validation in its configuration interface, allowing a cross‑site request forgery attack. An unauthenticated attacker can craft a forged request that, when a site administrator unknowingly clicks a link or visits a malicious page, updates the plugin’s settings. This can alter theme selection, deactivate or enable other plugin features, or otherwise modify site appearance and behavior without the admin’s knowledge.

WordPress sites that have the Darendev Simple Theme Changer plugin installed with version 1.0 or earlier are affected. Any site administrator who accesses the plugin’s settings through a forged request is at risk.

The CVSS score of 4.3 indicates a moderate impact, and the EPSS score of less than 1% suggests a low likelihood of exploitation under normal conditions. The vulnerability is not listed in CISA’s KEV catalog. The exploitation path requires the attacker to obtain a forged request and trick an administrator into executing it, making the attack vector an admin‑interaction CSRF scenario. While the probability is low, the impact to configuration integrity warrants prompt action.