The Theme Editor plugin for WordPress allows unauthenticated attackers to change the CSS of a child theme by exploiting missing nonce validation on the ms_update AJAX action. This flaw enables attackers to forge a request that, when an administrator unknowingly submits it (for example by clicking a malicious link), modifies the appearance of the site. While the vulnerability does not provide direct code execution, it can be used to alter a site’s visual presentation in ways that may mislead users or obscure legitimate content.

The vulnerability affects the Theme Editor plugin from the vendor mndpsingh287, in all releases up to and including version 3.1.

With a CVSS score of 4.3 and an EPSS score of less than 1%, the risk level is moderate to low and the likelihood of exploitation is currently low, especially since the vuln is not listed in the CISA KEV catalog. Attackers must craft a forged HTTP request to the ms_update action and lures an administrator into executing the request, typically via a malicious link. Once triggered, the plugin updates the CSS file without validating the caller, allowing alteration of theme styles.