CVE-2025-14469

Name of the Vulnerable Software and Affected Versions Theme Editor plugin for WordPress versions prior to 3.2

Description The plugin is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into executing unwanted actions on a web application. This occurs due to missing nonce validation—a security measure used to ensure that a request was intentionally sent by the user—on the ms update AJAX action. Unauthenticated attackers can exploit this to modify child theme CSS styles by tricking an administrator into clicking a malicious link.

Recommendations Update the Theme Editor plugin for WordPress to version 3.2 or later. As a temporary mitigation, restrict access to the ms update AJAX action.