Technical impact
The Advanced Twenty Seventeen WordPress plugin version 1.3.1 and earlier contains a flaw where the function that creates and activates a bundled child theme performs no capability or nonce validation. This omission allows any authenticated user, including subscribers, to trigger the action and change the active theme for the entire site. Additionally, the same unchecked action can be invoked via CSRF against any logged‑in user, including administrators, enabling an attacker to impersonate an admin and alter the theme without permission. The weakness involves CWE-862.
Affected Systems
WordPress sites that have installed the Advanced Twenty Seventeen plugin, versions 1.3.1 or earlier. The issue affects all instances of the plugin on such sites regardless of the site administrator’s configuration.
Risk and Exploitability
This vulnerability provides a form of privilege escalation for authenticated users and a CSRF vector that could be used by attackers to activate an attacker‑controlled theme on the site. The CVSS score of 5.4 and an EPSS score of <1% indicate a moderate risk, and the vulnerability is not listed in CISA’s KEV catalog. The lack of access control and missing nonce checks means that any logged‑in user, including administrators, could be targeted via CSRF to switch the active theme.
