The FoodBakery WordPress theme contains a CSRF vulnerability (CWE-352) due to missing or incorrect nonce validation on several critical functions related to file deletion, theme option management, widget settings export/import, and backup operations. This flaw allows unauthenticated attackers to induce an administrator to perform unauthorized actions via crafted requests, potentially leading to arbitrary file deletion, configuration changes, and backup manipulation. The vulnerability affects all versions up to and including 4.7. The CVSS 3.1 score of 8.8 reflects the ease of exploitation (network vector, low attack complexity, no privileges required, user interaction needed) and the high impact on confidentiality, integrity, and availability.

Successful exploitation can result in unauthorized deletion of files, modification of theme options, export and import of widget settings, generation and restoration of backups, and resetting of theme options. These impacts compromise the confidentiality, integrity, and availability of the affected WordPress site and its data. The attacker must trick an administrator into performing an action such as clicking a malicious link, but no authentication is required to initiate the attack. This could lead to site disruption, data loss, or unauthorized configuration changes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid interacting with untrusted links or requests that could trigger these theme functions. Monitoring for updates from Chimpstudio is recommended to apply any forthcoming patches promptly. No vendor advisory or patch links are currently provided.