The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to trick a logged‑in user into installing arbitrary plugins into the WordPress site. This bypass of CSRF protection (CWE‑352) can lead to the execution of malicious code, modification of site content, and potentially full compromise of the website’s integrity and availability. The exploit is carried out by visiting a crafted link while an authenticated user is still logged in, causing an unintended request to the site’s plugin installer.

The issue affects the Bluestreet theme for WordPress supplied by priyanshumittal. Any installation of the theme with version 1.7.3 or earlier is vulnerable. No other versions are listed as affected.

The CVSS base score of 9.6 classifies the flaw as Critical, while the EPSS score of less than 1% indicates that widespread exploitation has not yet been observed. The flaw is not listed in the CISA KEV catalog. The likely attack vector is a web‑based CSRF attack that requires an authenticated user to visit a malicious URL. Though the probability of exploitation is low, the potential impact is high, warranting immediate attention.