CVE Intelligence
Analysis AI-assisted

CVE-2026-39640: Theme Editor WordPress Plugin: CSRF Leading to Code Injection

CVE-2026-39640 is a Cross-Site Request Forgery (CSRF) issue in the Theme Editor plugin by mndpsingh287, which the record says allows code injection. The description covers versions from n/a through 3.2, and the CNA Patchstack scored it 9.6 (critical) under CVSS 3.1. The record lists no fixed version, no KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-39640 describes a Cross-Site Request Forgery (CSRF) weakness in the Theme Editor plugin (theme-editor) by mndpsingh287. The record states that the flaw allows code injection and maps it to CWE-352. The Patchstack reference is available at Patchstack database entry and the NVD entry at NVD CVE-2026-39640.

Impact

  • The record states that the issue allows code injection.
  • CSRF generally lets a website cause an authenticated user's browser to send requests the user did not intend. A logged-in privileged user who visits a malicious page could therefore be the trigger.
  • The CVSS 3.1 vector in the record (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) describes a network attack, low complexity, no privileges required, user interaction required, changed scope, and high impact to confidentiality, integrity and availability.
  • The Patchstack URL slug refers to remote code execution, but the record text itself only says code injection.

Affected products and versions

  • Product: Theme Editor (theme-editor) by mndpsingh287, identified as a WordPress plugin in the Patchstack reference.
  • Range stated in the description: from n/a through 3.2 inclusive.
  • The record has no structured affected or fixed version entries, so the description is the only version information available.

Exploitation status

  • The record shows the vulnerability is not listed in the CISA KEV catalog.
  • No confirmed active exploitation or exploitation in the wild is stated in the sources consulted.
  • The EPSS probability is 0.00201 with a percentile of 0.09219, dated 2026-10-13 in the record.

Remediation and mitigation

  • The record does not identify a fixed version. Check the official WordPress plugin repository or the vendor for a release newer than 3.2 and apply it.
  • If no fixed release is available and the plugin is not essential, deactivate and remove it.
  • Restrict administrator and editor accounts to people who need them, and encourage users to log out of administrative sessions when finished.
  • Restrict access to the plugin's administrative pages where the hosting environment allows it.
  • Disable direct file editing in WordPress where it is not needed, and limit who can change theme files.

Detection guidance

  • Review web server and WordPress logs for unexpected requests to the plugin's administrative functions, especially requests with unfamiliar referrers or outside normal administrator activity.
  • Monitor theme and plugin files for unexpected changes and compare them with trusted copies.
  • Watch for newly added or modified PHP files in theme directories and for unexpected administrator account changes.

Limitations of the available information

  • The record gives no structured affected versions, fixed version, or vendor advisory beyond the Patchstack reference.
  • The lower bound of the range is written as n/a, so the first affected version is unknown.
  • The CVSS data comes from the CNA Patchstack, and the record does not show a separate assessment.
  • Details of the attack mechanics and public proof-of-concept availability are not in the record.
  • The EPSS date is later than the publication date and should be verified against the current feed.

Frequently asked questions

What is CVE-2026-39640?

It is a Cross-Site Request Forgery issue in the Theme Editor plugin by mndpsingh287. The record says it allows code injection and affects versions from n/a through 3.2.

Is there a fixed version?

The record does not list a fixed version. Check the official plugin source for a release newer than 3.2, and remove the plugin if no fix is available and it is not needed.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.