The Inspiro WordPress theme contains a missing nonce check in its plugin installer. This flaw permits an unauthenticated attacker to forge a request that, when executed by a logged‑in administrator, causes the theme to install any plugin from the repository. The result is arbitrary plugin installation, which can introduce malicious code into the site. The vulnerability is categorized as a Cross‑Site Request Forgery, listed as CWE‑352.

WordPress sites that use the Inspiro theme version 2.1.2 or any earlier release are affected. The issue persists in all builds up to and including 2.1.2; the 2.1.3 release contains the fix that restores proper nonce validation. Site administrators should verify the theme version and upgrade promptly if they are on an impacted release.

The flaw carries a CVSS score of 8.1, classifying it as high severity. The EPSS score is below 1%, indicating a low likelihood that the vulnerability is actively exploited, and it is not currently listed in the CISA KEV catalog. An attacker can exploit it by sending a crafted link to an administrator, which, when clicked, initiates the vulnerable function. The required exploit is web‑based and relies on user interaction; thus sites with exposed administrative interfaces are realistic targets.