CVE-2026-39640

CriticalCVSS 9.6

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

A Cross-Site Request Forgery (CSRF) vulnerability in the Theme Editor WordPress plugin allows code injection. An attacker can trick an administrator into performing unintended actions.

Risk Assessment

An attacker can inject malicious code, potentially leading to full compromise of the WordPress site.

Recommendation

Update the Theme Editor plugin to version later than 3.2. Implement CSRF protections such as tokens.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in mndpsingh287 Theme Editor theme-editor allows Code Injection.This issue affects Theme Editor: from n/a through <= 3.2.