Customify WordPress Theme Cross-Site Request Forgery Vulnerability
Vulnerability
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Customify WordPress theme, specifically in version 0.4.11. The issue arises from inadequate nonce validation in the 'reset_customize_section' function, allowing unauthenticated attackers to manipulate theme customization settings. Exploitation requires tricking a site administrator into clicking a link that initiates the forged request.
Impact
Exploitation of this vulnerability allows for unauthorized changes to be made to theme customization settings, potentially disrupting the site's appearance or functionality.
Remediation
Users are advised to update the Customify theme to version 0.4.12 or a later patched version.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.