The Blackfyre theme for WordPress contains an unauthenticated Cross-Site Request Forgery (CSRF) weakness (CWE-352) that permits a remote attacker to cause a logged-in user to perform state-changing actions without their consent. The problem allows an attacker to force the victim to submit forged requests that can alter site configuration, publish or delete content, or otherwise exploit the privileges of the authenticated user. This can lead to data modification, loss of integrity, or unauthorized content changes.

Skywarrior’s Blackfyre WordPress theme is affected. All releases up to and including version 2.5.4 are vulnerable. No specific patch release is documented in the report, but any installation of the theme at or below 2.5.4 is susceptible until the theme is updated.

The CVSS v3.1 score of 6.5 classifies the vulnerability as medium severity, while the EPSS value of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to lure a logged-in visitor to the site or place a crafted link on a trusted page; the attack vector is thus web-based and requires the victim’s credentials. If exploited, the impact is limited to the permissions of the coerced user, but a privileged user could modify critical site settings or publish unwanted content.