aThemeArt Theme Helper: Cross-Site Request Forgery in WordPress plugin

Summary

The aThemeArt Theme Helper WordPress plugin, versions up to and including 1.0.8, does not sufficiently verify that requests were intentionally sent by the user. An attacker can create a malicious web page that makes a logged-in user perform unintended actions on the site. The attack requires that a privileged user, such as a WordPress administrator, visits the attacker's page while logged in. The CVSS base score is 8.8, but Patchstack rates the priority as low and the NVD analysis is still pending.

Affected

• aThemeArt Theme Helper WordPress plugin, all versions up to and including 1.0.8 (the lower bound is not specified in the CVE record)

Fixed in

Unknown. No fixed version or vendor advisory has been confirmed. Patchstack lists no official patch as available.

Workaround

• No vendor-confirmed workaround.
• Deactivate and remove the plugin if it is not needed; it is typically only used during theme setup.
• Check whether a WAF or virtual patch covers the issue.
• Log out of the WordPress admin area after making changes and avoid browsing other sites while logged in as an administrator.

Exploitation

• No known exploitation in the wild. CISA KEV: not listed.
• No public proof of concept found.
• CISA SSVC: exploitation none, not automatable, total technical impact.

Our recommendation

• Check whether the plugin is installed on any WordPress site.
• If installed, remove or deactivate it if it is not needed.
• Restrict administrator access and log out after administrative sessions.
• Check the Patchstack advisory and the WordPress.org plugin page for a fixed version, and install it as soon as one is published.
• Monitor the vendor and Patchstack for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• WordPress.org plugin page wordpress.org
• Strix CVE summary www.strix.ai
• VulDB entry 421284 vuldb.com
• SecurityFocus CVE entry www.securityfocus.com
• Positive Technologies PT-2026-115605 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:03.