CVE-2026-8423 describes a CSRF vulnerability in the JaviBola Custom Theme Test plugin for WordPress, affecting all versions up to 2.0.5. The root cause is the lack of proper nonce validation on the options page, which enables attackers to perform unauthorized changes to the site's active theme by exploiting the jbct_theme option. The attack requires tricking an authenticated site administrator into submitting a malicious request. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity. No known exploits are reported in the wild, and no official fix or patch has been published as of the data provided.

An attacker can cause a site administrator to unknowingly change the active theme of the WordPress site by exploiting the CSRF vulnerability. This results in unauthorized modification of site settings but does not directly impact confidentiality or availability. The integrity of the site's appearance and configuration is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links while logged into WordPress and consider implementing additional CSRF protections or disabling the vulnerable plugin if feasible.