The Cardealer WordPress theme is vulnerable to a cross‑site request forgery (CSRF) condition caused by missing nonce validation in the update_user_profile function. Because authentication is not properly checked, a malicious actor can craft a link that, when clicked by a website administrator, will silently change the administrator's email address and password. This leads to loss of control over the admin account or lockout of the legitimate user, allowing the attacker to gain unauthorized access to the WordPress site.

The vulnerability affects ThemeMakers' Car Dealer Automotive WordPress Theme – Responsive in all releases through version 1.6.4. Anyone currently using versions 1.6.4 or older is at risk.

The CVSS score of 8.8 indicates a high severity with a score of 8.8, while the EPSS score of less than 1% suggests that the likelihood of exploitation is currently low but not impossible. The vulnerability is not yet listed in the CISA KEV catalog. An attacker can exploit this flaw by sending an unauthenticated CSRF request to an administrator’s browser, typically by tricking the user into clicking a malicious link or visiting a compromised site. Because the attacker only requires the target to interact with a link, the threat model is widespread for sites that have an active administrator portal and no CSRF protection in place.