CVE-2026-57655
Deferred Deferred - Pending Action
Unauthenticated CSRF in Child Theme Wizard

Publication date: 2026-06-26

Last updated on: 2026-06-26

Assigner: Patchstack

Description
Unauthenticated Cross Site Request Forgery (CSRF) in Child Theme Wizard <= 1.4 versions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-26
Last Modified
2026-06-26
Generated
2026-06-26
AI Q&A
2026-06-26
EPSS Evaluated
N/A
NVD
CVE-2026-57655
EUVD
EUVD-2026-39770
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
patchstack child_theme_wizard to 1.4 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The WordPress Child Theme Wizard Plugin, versions 1.4 and below, is vulnerable to an unauthenticated Cross Site Request Forgery (CSRF) attack.

This vulnerability allows attackers to trick higher privileged users into executing unwanted actions while authenticated, by making them click a malicious link or visit a crafted page.

The vulnerability has a CVSS score of 8.2, indicating a significant risk.

Impact Analysis

This vulnerability can lead to attackers forcing privileged users to perform unintended actions on the website without their consent.

Such actions could compromise the integrity of the website, potentially leading to unauthorized changes or disruptions.

Because it requires user interaction, attackers often use mass campaigns to target many websites, increasing the risk of exploitation.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the WordPress Child Theme Wizard plugin to version 1.5 or later.

Enabling auto-updates for vulnerable plugins can also help ensure that the plugin remains up to date and protected against this CSRF vulnerability.

Detection Guidance

This vulnerability affects the WordPress Child Theme Wizard Plugin versions 1.4 and below. Detection involves identifying if the vulnerable plugin version is installed on your WordPress site.

You can check the installed plugin version by accessing your WordPress admin dashboard or by inspecting the plugin files directly.

From the command line, you can use commands to list the plugin version if you have access to the WordPress installation directory. For example:

  • Navigate to the plugins directory: cd wp-content/plugins/child-theme-wizard
  • Check the version in the plugin's main PHP file (usually contains a version header): grep 'Version' child-theme-wizard.php

Alternatively, you can scan your network traffic or logs for suspicious CSRF attack patterns, but this requires advanced monitoring and is not specifically detailed in the provided resources.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57655. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart