This vulnerability, identified as CVE-2026-57766, is an unauthenticated CSRF issue in the WPIDE – File Manager & Code Editor plugin by XplodedThemes, affecting versions up to 3.5.6. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. The vulnerability allows attackers to perform unauthorized actions by exploiting the lack of proper CSRF protections. No patch or official remediation level has been published as of the current data.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. Because it is unauthenticated and remotely exploitable with low complexity, attackers can potentially execute arbitrary actions within the plugin context by tricking users into performing malicious requests. This can result in unauthorized file modifications, code execution, or denial of service conditions within the affected WordPress environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the WPIDE – File Manager & Code Editor plugin to trusted administrators only and avoid interacting with untrusted content that could trigger CSRF attacks. Monitor vendor channels for updates and apply patches promptly once available.