The JetStyleManager for Gutenberg plugin before version 1.3.9 omits CSRF protection on several AJAX endpoints, allowing an attacker to craft a request that a logged‑in contributor or higher user can unintentionally trigger. When a vulnerable user clicks a malicious link or loads a page containing the request, the plugin unknowingly deletes or alters custom widget skins. This changes the visual presentation of the site, potentially disrupting branding or user experience, but does not directly compromise core application data or code.

Any WordPress site installing JetStyleManager for Gutenberg with a version earlier than 1.3.9 is impacted. The issue exists across all installations where contributors or higher roles have access to the plugin’s skin management functionality.

The vulnerability can be exploited by any threat actor capable of persuading an authenticated WordPress user to act on a crafted link. No authentication bypass or privilege escalation is required beyond the existing edit_posts capability. Because the flaw resides in missing CSRF checks, an exploit is straightforward to construct and does not require complex preparation. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog; however, the absence of CSRF protection makes it highly actionable for attackers targeting sites that rely on the JetStyleManager plugin for theme and widget presentation.