CVE-2025-10312 is a CSRF vulnerability in the steve-forster Theme Importer WordPress plugin caused by the absence of nonce validation when processing form submissions in theme-importer.php. This enables attackers to craft malicious requests that, when executed by an authenticated site administrator, can lead to arbitrary file downloads or other unauthorized actions. The vulnerability affects all versions up to and including 1.0. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact. No patch or vendor advisory is currently available.

An attacker can exploit this vulnerability by tricking a site administrator into submitting a malicious request, potentially causing arbitrary file downloads or other unauthorized operations on the affected WordPress site. There is no direct confidentiality or availability impact reported, but integrity impact is low. No known exploits have been observed in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when interacting with untrusted links or requests that could trigger theme importer actions. Implementing manual nonce validation or disabling the plugin if not required may reduce risk.