Description
The JaviBola Custom Theme Test plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on the options page. This makes it possible for unauthenticated attackers to change the site's active theme by modifying the jbct_theme option via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2026-05-20
Score: 4.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The JaviBola Custom Theme Test plugin contains a CSRF flaw in the options page because the nonce is missing or malformed. An unauthenticated attacker who can entice a logged‑in administrator to visit a crafted URL can force the site to switch to a theme chosen by the attacker. This does not expose secrets directly but can alter site appearance, potentially trigger additional vulnerabilities in the chosen theme, and may provide a foothold for further attacks. The vulnerability is classified as CWE‑352.

Affected Systems

WordPress sites running the JaviBola Custom Theme Test plugin version 2.0.5 or earlier. The plugin is distributed on the WordPress plugin repository and may appear on any WordPress installation that has installed this plugin.

Risk and Exploitability

The flaw has a CVSS score of 4.3, indicating moderate technical impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation data. The attack vector is inferred to be a web‑based CSRF, where an impersonated request must be sent from a browser session that has an authenticated administrator. The attacker requires social engineering to have the admin click a malicious link or submit a forged form.

Generated by OpenCVE AI on May 20, 2026 at 03:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the JaviBola Custom Theme Test plugin to the latest version that includes nonce validation on the options page.
  • If an update is not possible, deactivate or completely uninstall the plugin to eliminate the CSRF surface.
  • Ensure that WordPress core and other plugins are kept current and consider implementing a WAF rule that blocks unauthenticated POST requests to admin URLs lacking proper nonces.

Generated by OpenCVE AI on May 20, 2026 at 03:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 20 May 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Javibola
Javibola javibola Custom Theme Test
Wordpress
Wordpress wordpress
Vendors & Products Javibola
Javibola javibola Custom Theme Test
Wordpress
Wordpress wordpress

Wed, 20 May 2026 02:15:00 +0000

Type Values Removed Values Added
Description The JaviBola Custom Theme Test plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on the options page. This makes it possible for unauthenticated attackers to change the site's active theme by modifying the jbct_theme option via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Title JaviBola Custom Theme Test <= 2.0.5 - Cross-Site Request Forgery
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Subscriptions

Javibola Javibola Custom Theme Test
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-05-20T01:25:49.539Z

Reserved: 2026-05-12T17:48:27.843Z

Link: CVE-2026-8423

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-05-20T02:16:40.260

Modified: 2026-05-20T02:16:40.260

Link: CVE-2026-8423

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-20T10:38:26Z

Weaknesses