The wproyal Ashe theme is affected by a CSRF vulnerability (CVE-2024-37478) in versions up to 2.233. This vulnerability enables an attacker to induce an authenticated user to perform unintended actions without their consent. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity, no privileges required, and requires user interaction. The impact is limited to integrity with no confidentiality or availability impact reported.

The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user, potentially altering data or settings within the affected theme. There is no impact on confidentiality or availability according to the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing CSRF protections such as verifying anti-CSRF tokens in requests or restricting access to trusted users. Monitor vendor channels for updates regarding patches or official mitigations.