The mndpsingh287 Theme Editor plugin versions up to 3.2 contain a CSRF vulnerability that enables code injection. This means that an attacker could trick an authenticated user into submitting a forged request that injects malicious code into the theme editor. The vulnerability is documented under CVE-2026-39640 but lacks a CVSS score and official remediation guidance as of the publication date.

Successful exploitation could allow an attacker to inject arbitrary code into the theme editor, potentially leading to unauthorized code execution or site compromise. However, no known exploits have been reported in the wild, and the extent of impact depends on the victim's privileges and the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid exposing the theme editor interface to untrusted users and consider disabling or restricting access to the plugin to mitigate risk.