The Theme Editor plugin for WordPress contains a cross‑site request forgery flaw that lets an attacker inject arbitrary code. Once the malicious payload is executed, the attacker gains remote code execution privileges on the affected WordPress site, enabling full compromise of confidentiality, integrity, and availability.

The flaw exists in all releases of the Theme Editor plugin by mndpsingh287 up to and including version 3.2. Any WordPress installation that has the plugin installed and older than this release is affected.

The vulnerability carries a CVSS score of 9.6, indicating a critical level of severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and it has not been listed in the CISA KEV catalog. The attack vector is most likely through a CSRF request made by a logged‑in administrator or other privileged user; the attacker would need to persuade the victim to visit a crafted URL or submit a crafted form while authenticated. The absence of an immediate patch notice means site owners should treat the issue as serious and remediate promptly.