The mndpsingh287 Theme Editor plugin versions up to 3.2 contain a Cross-Site Request Forgery (CSRF) vulnerability that enables attackers to inject malicious code by tricking authenticated users into submitting unauthorized requests. This vulnerability can lead to complete compromise of the affected system's confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and scope change with high impact on all security properties. No patch or official remediation has been disclosed yet.

Successful exploitation of this vulnerability can result in code injection, allowing attackers to execute arbitrary code within the context of the affected application. This can lead to full system compromise, data theft, or service disruption. The vulnerability affects all users of the Theme Editor plugin up to version 3.2. There are no known active exploits currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the Theme Editor plugin or restricting access to it to trusted administrators only. Monitor for updates from the vendor and apply patches promptly once available.