Cross‑Site Request Forgery (CSRF) enables an attacker to perform state‑changing operations on a WordPress site by tricking a logged‑in user into submitting a forged request through the Waituk Entrada theme. The flaw lies in the theme's handling of form submissions, allowing an unauthenticated attacker to trigger actions with the victim's privileges. This weakness is classified as CWE-352.

All recent releases of the Entrada theme before version 5.7.8 are vulnerable, including every build from the earliest release up to 5.7.7. The vulnerability affects WordPress installations that have the Entrada theme active, regardless of the hosting environment or user role, with an attacker needing only to convince a legitimate user to visit a crafted URL.

The CVSS score of 4.3 indicates moderate risk, while the EPSS score of less than 1% suggests scarce current exploitation. The theme is not listed in the CISA KEV catalog. Exploitation likely requires the user to be logged in, after which the attacker can send a crafted form or click link, resulting in unintended actions on the site. Given the modest likelihood, monitoring for abnormal form submissions or anomalous administrative actions remains prudent.