The vulnerability described in the CVE allows Cross‑Site Request Forgery (CSRF) against the Corpiva WordPress theme. This weakness, identified as CWE‑352, enables an attacker to cause the theme to perform actions on behalf of an authenticated user without that user’s consent. The damage is limited to functions that the authenticated user can normally execute, potentially affecting content integrity and site configuration.

The affected vendor is desertthemes and the product is the Corpiva WordPress theme. All installations of version 1.0.96 or earlier are vulnerable, while later releases are presumed unaffected.

The CVSS score of 4.3 indicates medium severity, and the EPSS score is below 1%, suggesting a low probability of exploitation in the wild. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an authenticated user unknowingly submitting a forged request—this inference is based on the nature of CSRF weaknesses and is not explicitly provided in the CVE data. Successful exploitation would replace or delete content, modify settings, or otherwise alter the site state within the permissions of the user that is coerced into the request.