Cross‑Site Request Forgery in the Findgo WordPress theme allows a non‑authenticated or low‑privileged user to trigger privileged actions by tricking a logged‑in administrator into visiting a crafted URL or submitting a forged request. The flaw bypasses normal authentication checks, enabling the attacker to perform actions that normally require administrator authority, thereby compromising confidentiality, integrity, and availability of the site. This weakness is identified as CWE‑352.

The issue affects the ApusTheme Findgo theme through version 1.3.55. Any WordPress installation using Findgo 1.3.55 or older is vulnerable; newer releases are presumed fixed.

The CVSS score is 8.8, indicating high severity. The EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, but its authentication‑bypass nature means that an attacker with simply the ability to lure an administrator can gain full control of the site. The attack vector is clearly web‑based, requiring a crafted request against the target WordPress site. If an administrator inadvertently visits or submits data, the exploit succeeds without further conditions.