The Advanced Twenty Seventeen WordPress plugin version 1.3.1 and earlier contains a flaw where the function that creates and activates a bundled child theme performs no capability or nonce validation. This omission allows any authenticated user, including subscribers, to trigger the action and change the active theme for the entire site. Additionally, the same unchecked action can be invoked via CSRF against any logged‑in user, including administrators, enabling an attacker to impersonate an admin and alter the theme without permission.

WordPress sites that have installed the Advanced Twenty Seventeen plugin, versions 1.3.1 or earlier. The issue affects all instances of the plugin on such sites regardless of the site administrator’s configuration.

This vulnerability provides a form of privilege escalation for authenticated users and a CSRF vector that could be used by attackers to make an attacker‑controlled theme active on the site. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, but the lack of access control and CSRF protection indicates a moderate but actionable risk; any site using the vulnerable plugin should be patched promptly.