A Cross‑Site Request Forgery vulnerability has been discovered in the ApusTheme Findgo WordPress theme, allowing an attacker to craft a request that is automatically submitted by a victim’s browser. Because the application does not adequately validate the source of the request, an attacker could cause the victim to perform arbitrary actions on the site under the victim’s credentials. The weakness is classified as CWE‑352 and scored as high risk with a CVSS base score of 8.8.

The flaw affects the ApusTheme Findgo theme for WordPress, versions up to and including 1.3.57. No specific build or platform constraints were provided, so all installations running a vulnerable version are potentially exposed.

The CVSS score of 8.8 indicates that this defect has a high potential impact if exploited. The EPSS score of less than 1% shows that current observed exploitation is extremely low, and the vulnerability is not listed in the CISA KEV catalog. Attackers would typically need to entice a logged‑in site user to visit a crafted URL or embed malicious content; no network‑level privilege escalation or privileged user credentials are required for the attack.