This vulnerability in stmcan RT-Theme 18 | Extensions (versions up to 2.5) allows Cross-Site Request Forgery (CSRF) attacks. CSRF vulnerabilities enable attackers to induce users to perform actions they did not intend by exploiting the user's authenticated session. The CVSS 3.1 vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts integrity and availability but not confidentiality. No vendor advisory or patch information is provided, and the vulnerability is publicly disclosed as of April 2026.

Successful exploitation could allow an attacker to cause limited integrity and availability impacts by tricking authenticated users into executing unwanted actions. Confidentiality is not affected. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing CSRF protections such as verifying anti-CSRF tokens in requests or restricting actions to POST methods with proper validation, if feasible within the application environment.