Unauthenticated Cross Site Request Forgery (CSRF) enables an attacker to trick a logged‑in user into performing unintended actions within the WordPress Child Theme Wizard plugin. The flaw allows any user who is authenticated in WordPress to unknowingly execute commands that modify or persist data, potentially compromising site integrity and allowing further exploitation if sensitive operations are exposed through the plugin.

The vulnerability affects the Child Theme Wizard WordPress plugin, version 1.4 and earlier, published by Jay Versluis. Users who have installed these plugin versions are at risk, regardless of the WordPress core version, since the plugin lacks proper CSRF protection.

The CVSS score of 8.2 classifies the issue as high severity, and the absence of an EPSS score indicates current known exploitation activity remains uncertain. The vulnerability is not listed in CISA’s KEV catalog, but the high severity and the nature of CSRF mean that an attacker can exploit it easily by hosting a malicious page that issues requests on behalf of a victim’s browser while they are logged into the site.