The vulnerability exists in the aThemeArt Theme Helper plugin up to and including version 1.0.8. An attacker can exploit a missing or improper CSRF check, sending a crafted request that is executed with the victim’s credentials and privileges. This can result in the attacker altering site settings, publishing content, or performing other administrative actions, compromising the authenticity and integrity of the WordPress site. Based on the description, it is inferred that the attack requires an authenticated user to be tricked into visiting a malicious URL or submitting a forged form.

WordPress installations using the aThemeArt Theme Helper plugin, specifically versions from the initial release through 1.0.8.

The CVSS base score of 8.8 indicates high severity, and although EPSS data is not available, the lack of a KEV listing does not reduce the potential for exploitation. Based on the description, it is inferred that the attack requires an authenticated user to be tricked into visiting a malicious URL or submitting a forged form. Because the vulnerability is tied to standard WordPress authentication, any site with the affected plugin and active administrative accounts is at risk.