The Constructo theme contains a Cross‑Site Request Forgery (CSRF) weakness that allows an attacker to inject arbitrary objects. The flaw could be exploited to modify server data or trigger unintended actions by forcing a logged‑in user to submit a crafted request. The vulnerability aligns with CWE‑352 and carries a CVSS score of 8.8, indicating a high‑severity risk.

WordPress sites that employ the Anps Constructo Theme version 4.3.9 or earlier. The theme is distributed by the vendor Anps.

The high CVSS rating reflects substantial potential damage if the flaw is abused. However, the EPSS score of less than 1% suggests that attacks are currently rare, and the issue is not listed in the CISA KEV catalog. The logical exploitation path would involve an authenticated user clicking a malicious link or submitting a forged form that triggers the theme's object‑injection routine. No officially published workaround exists; therefore, the safest approach is to apply the vendor’s patch or update.