CVE-2025-14469
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 3.1 due to missing nonce validation on the ms_update AJAX action. This allows unauthenticated attackers to modify child theme CSS styles via a forged request if they can trick an administrator into clicking a link.
Risk Assessment
An attacker can change the site's appearance by modifying CSS, potentially leading to defacement or injection of malicious content. This requires administrator interaction but can be exploited in social engineering attacks.
Recommendation
Immediately update the Theme Editor plugin to the latest version that fixes this vulnerability. Also educate administrators about the risks of clicking suspicious links.
Other vulnerabilities in Theme Editor
Original NVD description (English source)
The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1. This is due to missing nonce validation on the ms_update AJAX action. This makes it possible for unauthenticated attackers to modify child theme CSS styles via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS