Customify version 0.4.11 contains a missing or incorrect nonce check in the reset_customize_section function. The absence of proper verification allows a Cross‑Site Request Forgery attack, giving an unauthenticated attacker the ability to trigger a reset of a site’s theme customization settings. This flaw is documented as CWE-352. The attacker does not gain direct access to site data or code but can force a visual configuration change that may hide or alter critical content.

The vulnerability applies to the Customify theme developed by pressmaximum, specifically version 0.4.11. Any WordPress site using this version is susceptible until it is updated to a patched release.

The CVSS score of 4.3 indicates medium overall risk, while the EPSS score of less than 1% suggests a low probability of exploitation with current knowledge. The flaw is not in the CISA KEV catalog. Attackers typically need to entice an authenticated administrator into executing a forged request, often via a malicious link or embedded form, but no privileged credentials are required to perform the reset.