CVE-2026-8423
Cross-Site Request Forgery in JaviBola Custom Theme Test WordPress Plugin
Publication date: 2026-05-20
Last updated on: 2026-05-20
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| javibola | custom_theme_test | to 2.0.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The JaviBola Custom Theme Test plugin for WordPress has a vulnerability known as Cross-Site Request Forgery (CSRF) in all versions up to and including 2.0.5.
This vulnerability exists because the plugin's options page lacks proper nonce validation, which is a security measure to verify that requests are legitimate.
As a result, an unauthenticated attacker can trick a site administrator into performing an action, such as clicking a malicious link, which then changes the site's active theme by modifying the jbct_theme option without the administrator's consent.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to change the active theme of your WordPress site without your permission.
While it does not directly compromise confidentiality or availability, it can impact the integrity of your site by altering its appearance or functionality unexpectedly.
Such unauthorized changes could confuse users, damage your site's reputation, or potentially be used as a stepping stone for further attacks.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update the JaviBola Custom Theme Test plugin to a version later than 2.0.5 where the nonce validation issue is fixed.
Additionally, avoid clicking on suspicious links or performing actions from untrusted sources to prevent Cross-Site Request Forgery attacks.