The Colibri WP theme for WordPress contains a CSRF vulnerability due to improper nonce validation in the colibriwp_install_plugin() function. This allows unauthenticated attackers to cause site administrators to install plugins without their explicit consent by exploiting the lack of proper request validation. The vulnerability affects all versions up to 1.0.94. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction. No known exploits are reported in the wild.

An attacker can leverage this vulnerability to cause a site administrator to unknowingly install plugins via forged requests. This could lead to the installation of potentially unwanted or malicious plugins, impacting the integrity of the site. However, the vulnerability does not directly allow confidentiality or availability impacts. The attack requires user interaction (the administrator must be tricked into clicking a link).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when clicking links and consider restricting administrative access or using security plugins that provide CSRF protections. Monitor official extendthemes communications for updates regarding a patch or official fix.