The momen2009 Theme Changer plugin versions up to 1.4 contain a CSRF vulnerability that enables attackers to induce authenticated users to perform unintended actions related to theme changes. This vulnerability does not require privileges (PR:N) but does require user interaction (UI:R). The attack vector is network-based (AV:N), and the impact is limited to integrity (I:L) with no confidentiality or availability impact. The vulnerability is publicly disclosed but lacks an official patch or mitigation guidance from the vendor.

Successful exploitation could allow an attacker to modify theme settings by leveraging the victim's authenticated session, potentially leading to unauthorized changes in the website's appearance or configuration. There is no impact on confidentiality or availability reported. The overall impact is limited to integrity with medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, consider implementing CSRF protections such as verifying anti-CSRF tokens on requests that change theme settings. Monitor for updates from the vendor regarding patches or official mitigations.