Cross‑Site Request Forgery (CWE‑352) is present in Frenify Mow theme versions up to 4.10. The flaw permits an attacker to inject code on a vulnerable WordPress site by tricking a logged‑in administrator into submitting a forged request. The injected code would run with the privileges of that administrator. Based on the description, it is inferred that such code could potentially lead to further compromise, but the exact scope depends on the code executed and the site configuration.

Affecting WordPress sites that use the Frenify Mow theme version 4.10 or earlier, any installation that has not been updated to a newer release remains vulnerable. The vulnerability applies to all theme files that handle state‑changing requests without proper CSRF protection.

With a CVSS score of 9.6 the flaw is considered critical, while an EPSS score of less than 1% suggests that exploitation cases have not been observed. The vulnerability is not listed in the CISA KEV catalog. Based on standard CSRF characteristics, an attacker would need an authenticated session or would have to trick a logged‑in user into sending a forged request; this is inferred from the description. Even though the likelihood is low, the high severity warrants prompt remediation.