WordPress Cardealer Theme Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Cardealer theme for WordPress, affecting versions through 1.6.4. The issue arises from inadequate nonce validation in the 'update_user_profile' function, allowing unauthenticated attackers to manipulate user email and password by sending forged requests. This exploitation requires tricking a site administrator into performing a specific action, such as clicking a link.

Impact

Exploitation of this vulnerability allows for unauthorized changes to user email and password, potentially leading to account takeover.

Remediation

Users are advised to update to version 1.6.5 or a later patched version.