The Theme Editor plugin is vulnerable to a Cross‑Site Request Forgery flaw due to missing or incorrect nonce validation on the 'theme_editor_theme' page. An attacker can send a forged request that, if a site administrator clicks a malicious link, escalates to remote code execution. This makes the affected site a direct target for unauthenticated attackers, compromising both confidentiality and integrity of site files.

The vulnerability applies to the WordPress Theme Editor plugin developed by mndpsingh287 for all releases up to and including version 3.0. Any site running these affected versions faces the risk until an update is applied.

The CVSS score of 8.8 indicates a high‑severity flaw, while the EPSS score of less than 1% suggests exploitation is presently unlikely, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a simple CSRF via a malicious link or embed sent to an admin user. If exploited, the attacker gains the capability to execute arbitrary code on the server.