CVE-2026-57655

2th percentile — higher than 2% of all known CVEs

The vulnerability allows an unauthenticated attacker to perform a Cross-Site Request Forgery (CSRF) in the Child Theme Wizard plugin version 1.4 and earlier. The attack can lead to unauthorized changes in the plugin configuration without the administrator's knowledge.

The risk involves the possibility of an attacker taking control of child theme settings, which could result in malicious code injection or compromise of site integrity.

Immediately update the Child Theme Wizard plugin to the latest available version that fixes this vulnerability. In the meantime, consider temporarily disabling the plugin.