CVE-2026-81432: CWE-352 Cross-Site Request Forgery (CSRF) in JetStyleManager for Gutenberg

The JetStyleManager for Gutenberg WordPress plugin prior to version 1.3.9 does not implement CSRF protections on some AJAX endpoints. This allows attackers to exploit the lack of validation by crafting malicious requests that a logged-in user with the edit_posts capability (Contributor role or higher) might unknowingly execute, resulting in unauthorized deletion or modification of custom widget skins. The vulnerability is identified as CWE-352 and has a CVSS 3.1 base score of 4.3, indicating medium severity. There is no official patch or remediation level currently provided, and no known exploits in the wild have been reported.

An attacker can cause a logged-in user with edit_posts capability to unknowingly delete or modify custom widget skins by tricking them into performing an action such as clicking a malicious link. This impacts the integrity of the affected plugin's custom widget skins but does not affect confidentiality or availability. The attack requires user interaction and privileges at least at the Contributor level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should limit user roles to trusted users and avoid clicking suspicious links. Monitor for updates from the JetStyleManager plugin vendor regarding patches or official mitigations.