The WP Editor plugin for WordPress fails to verify nonces in the functions that render the plugin and theme file editor pages. This missing protection enables a Cross‑Site Request Forgery (CSRF) attack in which an unauthenticated attacker can forge a request that an administrator will inadvertently execute. By doing so the attacker can overwrite any PHP file in the plugin or theme directories with attacker‑controlled code, leading to full remote code execution on the site. The vulnerability is indexed as CWE‑352.

The vulnerability affects the WP Editor plugin for WordPress from vendor benjaminprojas, in all released builds up to and including version 1.2.9.2. Any WordPress site that has this plugin installed at a vulnerable version is susceptible.

The assigned CVSS score of 8.8 indicates a high severity issue. EPSS is not available and the vulnerability is not currently listed in CISA’s KEV catalog, but the exploitation potential is significant because remote code execution is possible. The attack requires the attacker to convince an administrator to perform an action such as clicking a link, so social engineering is a prerequisite. Once the admin action succeeds, the attacker can exfiltrate data, deface the site, or pivot to other assets.