PT-2025-42710 · WordPress · Theme Editor

Published 2025-10-18 · Updated 2025-10-18 · CVE-2025-9890

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress Theme Editor plugin versions prior to 3.1

Description The software is susceptible to a Cross-Site Request Forgery (CSRF) issue. This is caused by inadequate or missing nonce validation on the 'theme editor theme' page. Successful exploitation could allow unauthenticated attackers to execute code remotely by deceiving a site administrator into performing an action, such as clicking a malicious link.

Recommendations Update the WordPress Theme Editor plugin to version 3.1 or later.

Fix

RCE

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-9890

Affected Products

Theme Editor

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-9890 · Security Note
• https://twitter.com/CVEnew/status/1979470781894533150 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1979494362779115889 · Twitter Post
• https://plugins.trac.wordpress.org/browser/theme-editor/trunk/app/controller/theme_controller.php#L87 · Note
• https://t.me/cveNotify/139336 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/77189684-b794-41a0-8fc0-3320032c2f69?source=cve · Note
• https://t.me/CVEtracker/35279 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3379404%40theme-editor&new=3379404%40theme-editor&sfp_email=&sfph_mail= · Note