CVE-2024-1943: CWE-352 Cross-Site Request Forgery (CSRF) in wpmoose Yuki
The Yuki theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including 1.3.14. This is due to missing or incorrect nonce validation on the reset_customizer_options() function. This makes it possible for unauthenticated attackers to reset the themes settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AI Analysis
Technical Summary
CVE-2024-1943 identifies a CSRF vulnerability in the Yuki WordPress theme versions up to 1.3.14. The issue arises from inadequate nonce validation in the reset_customizer_options() function, enabling attackers to perform unauthorized resets of theme settings if they can induce an authenticated administrator to execute a crafted request. The vulnerability requires user interaction (UI:R) and does not impact confidentiality or availability but can cause limited integrity loss by altering theme configurations.
Potential Impact
An attacker can cause an authenticated site administrator to unknowingly reset the theme's customization settings, potentially disrupting site appearance or configuration. There is no direct impact on confidentiality or availability. The integrity of theme settings is affected, but the attack requires tricking an administrator into clicking a malicious link or similar action.
Mitigation Recommendations
No official patch or fix is currently available. Administrators should exercise caution when interacting with untrusted links and monitor updates from the wpmoose vendor for a forthcoming security update addressing this CSRF vulnerability. Until a fix is released, limiting administrative access and educating administrators about CSRF risks can help reduce exposure.
CVE-2024-1943: CWE-352 Cross-Site Request Forgery (CSRF) in wpmoose Yuki
Description
The Yuki theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including 1.3.14. This is due to missing or incorrect nonce validation on the reset_customizer_options() function. This makes it possible for unauthenticated attackers to reset the themes settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-1943 identifies a CSRF vulnerability in the Yuki WordPress theme versions up to 1.3.14. The issue arises from inadequate nonce validation in the reset_customizer_options() function, enabling attackers to perform unauthorized resets of theme settings if they can induce an authenticated administrator to execute a crafted request. The vulnerability requires user interaction (UI:R) and does not impact confidentiality or availability but can cause limited integrity loss by altering theme configurations.
Potential Impact
An attacker can cause an authenticated site administrator to unknowingly reset the theme's customization settings, potentially disrupting site appearance or configuration. There is no direct impact on confidentiality or availability. The integrity of theme settings is affected, but the attack requires tricking an administrator into clicking a malicious link or similar action.
Mitigation Recommendations
No official patch or fix is currently available. Administrators should exercise caution when interacting with untrusted links and monitor updates from the wpmoose vendor for a forthcoming security update addressing this CSRF vulnerability. Until a fix is released, limiting administrative access and educating administrators about CSRF risks can help reduce exposure.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2024-02-27T18:21:39.568Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 699f6d44b7ef31ef0b56f893
Added to database: 2/25/2026, 9:44:36 PM
Last enriched: 4/9/2026, 7:10:34 AM
Last updated: 4/12/2026, 3:44:38 PM
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.