PT-2026-42079 · WordPress · Javibola Custom Theme Test

Ibnu + 1 · Published 2026-05-20 · Updated 2026-05-28 · CVE-2026-8423

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions JaviBola Custom Theme Test versions prior to 2.0.6

Description The JaviBola Custom Theme Test plugin for WordPress contains a Cross-Site Request Forgery (CSRF) flaw, which occurs when a web application allows an attacker to induce a user to perform actions they did not intend to. This issue is caused by missing or incorrect nonce validation on the options page. Unauthenticated attackers can change the active theme of a site by modifying the jbct theme option through a forged request, provided they can trick a site administrator into clicking a link.

Recommendations Update to a version newer than 2.0.5.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-8423

Affected Products

Javibola Custom Theme Test

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-8423 · Security Note
• https://plugins.trac.wordpress.org/browser/javibola-custom-theme/tags/2.0.5/javibola-custom-theme.php#L54 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/68a8a277-2ea6-4d75-b8cd-4d20eb17b3aa?source=cve · Note
• https://plugins.trac.wordpress.org/browser/javibola-custom-theme/trunk/javibola-custom-theme.php#L40 · Note
• https://plugins.trac.wordpress.org/browser/javibola-custom-theme/trunk/javibola-custom-theme.php#L41 · Note
• https://reddit.com/r/StopBadBots/comments/1tqd1k6/critical_38_plugins_no_fix_no_mercy_if_youve_got · Reddit Post
• https://plugins.trac.wordpress.org/browser/javibola-custom-theme/tags/2.0.5/javibola-custom-theme.php#L40 · Note
• https://plugins.trac.wordpress.org/browser/javibola-custom-theme/tags/2.0.5/javibola-custom-theme.php#L41 · Note
• https://plugins.trac.wordpress.org/browser/javibola-custom-theme/trunk/javibola-custom-theme.php#L54 · Note
• https://t.me/CVEtracker/54327 · Telegram Post