WordPress Vulnerabilities

WP < 7.1.1 - Theme Installation via CSRF

Description

WordPress does not properly handle a parameter of the theme installer screen in some cases, which could allow attackers to make a logged in administrator install a theme from the WordPress.org directory via a crafted link.

Affects WordPress

7.1
Fixed in WordPress 7.1.1
7.0.4
Fixed in WordPress 7.0.5
7.0.3
Fixed in WordPress 7.0.5
7.0.2
Fixed in WordPress 7.0.5
7.0.1
Fixed in WordPress 7.0.5
7.0
Fixed in WordPress 7.0.5
6.9.7
Fixed in WordPress 6.9.8
6.9.6
Fixed in WordPress 6.9.8
6.9.5
Fixed in WordPress 6.9.8
6.9.4
Fixed in WordPress 6.9.8
6.9.3
Fixed in WordPress 6.9.8
6.9.2
Fixed in WordPress 6.9.8
6.9.1
Fixed in WordPress 6.9.8
6.9
Fixed in WordPress 6.9.8
6.8.8
Fixed in WordPress 6.8.9
6.8.7
Fixed in WordPress 6.8.9
6.8.6
Fixed in WordPress 6.8.9
6.8.5
Fixed in WordPress 6.8.9
6.8.4
Fixed in WordPress 6.8.9
6.8.3
Fixed in WordPress 6.8.9
6.8.2
Fixed in WordPress 6.8.9
6.8.1
Fixed in WordPress 6.8.9
6.8
Fixed in WordPress 6.8.9
6.7.7
Fixed in WordPress 6.7.8
6.7.6
Fixed in WordPress 6.7.8
6.7.5
Fixed in WordPress 6.7.8
6.7.4
Fixed in WordPress 6.7.8
6.7.3
Fixed in WordPress 6.7.8
6.7.2
Fixed in WordPress 6.7.8
6.7.1
Fixed in WordPress 6.7.8
6.7
Fixed in WordPress 6.7.8
6.6.7
Fixed in WordPress 6.6.8
6.6.6
Fixed in WordPress 6.6.8
6.6.5
Fixed in WordPress 6.6.8
6.6.4
Fixed in WordPress 6.6.8
6.6.3
Fixed in WordPress 6.6.8
6.6.2
Fixed in WordPress 6.6.8
6.6.1
Fixed in WordPress 6.6.8
6.6
Fixed in WordPress 6.6.8
6.5.10
Fixed in WordPress 6.5.11
6.5.9
Fixed in WordPress 6.5.11
6.5.8
Fixed in WordPress 6.5.11
6.5.7
Fixed in WordPress 6.5.11
6.5.6
Fixed in WordPress 6.5.11
6.5.5
Fixed in WordPress 6.5.11
6.5.4
Fixed in WordPress 6.5.11
6.5.3
Fixed in WordPress 6.5.11
6.5.2
Fixed in WordPress 6.5.11
6.5
Fixed in WordPress 6.5.11
6.4.10
Fixed in WordPress 6.4.11
6.4.9
Fixed in WordPress 6.4.11
6.4.8
Fixed in WordPress 6.4.11
6.4.7
Fixed in WordPress 6.4.11
6.4.6
Fixed in WordPress 6.4.11
6.4.5
Fixed in WordPress 6.4.11
6.4.4
Fixed in WordPress 6.4.11
6.4.3
Fixed in WordPress 6.4.11
6.4.2
Fixed in WordPress 6.4.11
6.4.1
Fixed in WordPress 6.4.11
6.4
Fixed in WordPress 6.4.11
6.3.10
Fixed in WordPress 6.3.11
6.3.9
Fixed in WordPress 6.3.11
6.3.8
Fixed in WordPress 6.3.11
6.3.7
Fixed in WordPress 6.3.11
6.3.6
Fixed in WordPress 6.3.11
6.3.5
Fixed in WordPress 6.3.11
6.3.4
Fixed in WordPress 6.3.11
6.3.3
Fixed in WordPress 6.3.11
6.3.2
Fixed in WordPress 6.3.11
6.3.1
Fixed in WordPress 6.3.11
6.3
Fixed in WordPress 6.3.11
6.2.11
Fixed in WordPress 6.2.12
6.2.10
Fixed in WordPress 6.2.12
6.2.9
Fixed in WordPress 6.2.12
6.2.8
Fixed in WordPress 6.2.12
6.2.7
Fixed in WordPress 6.2.12
6.2.6
Fixed in WordPress 6.2.12
6.2.5
Fixed in WordPress 6.2.12
6.2.4
Fixed in WordPress 6.2.12
6.2.3
Fixed in WordPress 6.2.12
6.2.2
Fixed in WordPress 6.2.12
6.2.1
Fixed in WordPress 6.2.12
6.2
Fixed in WordPress 6.2.12
6.1.12
Fixed in WordPress 6.1.13
6.1.11
Fixed in WordPress 6.1.13
6.1.10
Fixed in WordPress 6.1.13
6.1.9
Fixed in WordPress 6.1.13
6.1.8
Fixed in WordPress 6.1.13
6.1.7
Fixed in WordPress 6.1.13
6.1.6
Fixed in WordPress 6.1.13
6.1.5
Fixed in WordPress 6.1.13
6.1.4
Fixed in WordPress 6.1.13
6.1.3
Fixed in WordPress 6.1.13
6.1.2
Fixed in WordPress 6.1.13
6.1.1
Fixed in WordPress 6.1.13
6.1
Fixed in WordPress 6.1.13
6.0.14
Fixed in WordPress 6.0.15
6.0.13
Fixed in WordPress 6.0.15
6.0.12
Fixed in WordPress 6.0.15
6.0.11
Fixed in WordPress 6.0.15
6.0.10
Fixed in WordPress 6.0.15
6.0.9
Fixed in WordPress 6.0.15
6.0.8
Fixed in WordPress 6.0.15
6.0.7
Fixed in WordPress 6.0.15
6.0.6
Fixed in WordPress 6.0.15
6.0.5
Fixed in WordPress 6.0.15
6.0.4
Fixed in WordPress 6.0.15
6.0.3
Fixed in WordPress 6.0.15
6.0.2
Fixed in WordPress 6.0.15
6.0.1
Fixed in WordPress 6.0.15
6.0
Fixed in WordPress 6.0.15
5.9.16
Fixed in WordPress 5.9.17
5.9.15
Fixed in WordPress 5.9.17
5.9.14
Fixed in WordPress 5.9.17
5.9.13
Fixed in WordPress 5.9.17
5.9.12
Fixed in WordPress 5.9.17
5.9.11
Fixed in WordPress 5.9.17
5.9.10
Fixed in WordPress 5.9.17
5.9.9
Fixed in WordPress 5.9.17
5.9.8
Fixed in WordPress 5.9.17
5.9.7
Fixed in WordPress 5.9.17
5.9.6
Fixed in WordPress 5.9.17
5.9.5
Fixed in WordPress 5.9.17
5.9.4
Fixed in WordPress 5.9.17
5.9.3
Fixed in WordPress 5.9.17
5.9.2
Fixed in WordPress 5.9.17
5.9.1
Fixed in WordPress 5.9.17
5.9
Fixed in WordPress 5.9.17
5.8.15
Fixed in WordPress 5.8.16
5.8.14
Fixed in WordPress 5.8.16
5.8.13
Fixed in WordPress 5.8.16
5.8.12
Fixed in WordPress 5.8.16
5.8.11
Fixed in WordPress 5.8.16
5.8.10
Fixed in WordPress 5.8.16
5.8.9
Fixed in WordPress 5.8.16
5.8.8
Fixed in WordPress 5.8.16
5.8.7
Fixed in WordPress 5.8.16
5.8.6
Fixed in WordPress 5.8.16
5.8.5
Fixed in WordPress 5.8.16
5.8.4
Fixed in WordPress 5.8.16
5.8.3
Fixed in WordPress 5.8.16
5.8.2
Fixed in WordPress 5.8.16
5.8.1
Fixed in WordPress 5.8.16
5.8
Fixed in WordPress 5.8.16
5.7.17
Fixed in WordPress 5.7.18
5.7.16
Fixed in WordPress 5.7.18
5.7.15
Fixed in WordPress 5.7.18
5.7.14
Fixed in WordPress 5.7.18
5.7.13
Fixed in WordPress 5.7.18
5.7.12
Fixed in WordPress 5.7.18
5.7.11
Fixed in WordPress 5.7.18
5.7.10
Fixed in WordPress 5.7.18
5.7.9
Fixed in WordPress 5.7.18
5.7.8
Fixed in WordPress 5.7.18
5.7.7
Fixed in WordPress 5.7.18
5.7.6
Fixed in WordPress 5.7.18
5.7.5
Fixed in WordPress 5.7.18
5.7.4
Fixed in WordPress 5.7.18
5.7.3
Fixed in WordPress 5.7.18
5.7.2
Fixed in WordPress 5.7.18
5.7.1
Fixed in WordPress 5.7.18
5.7
Fixed in WordPress 5.7.18
5.6.19
Fixed in WordPress 5.6.20
5.6.18
Fixed in WordPress 5.6.20
5.6.17
Fixed in WordPress 5.6.20
5.6.16
Fixed in WordPress 5.6.20
5.6.15
Fixed in WordPress 5.6.20
5.6.14
Fixed in WordPress 5.6.20
5.6.13
Fixed in WordPress 5.6.20
5.6.12
Fixed in WordPress 5.6.20
5.6.11
Fixed in WordPress 5.6.20
5.6.10
Fixed in WordPress 5.6.20
5.6.9
Fixed in WordPress 5.6.20
5.6.8
Fixed in WordPress 5.6.20
5.6.7
Fixed in WordPress 5.6.20
5.6.6
Fixed in WordPress 5.6.20
5.6.5
Fixed in WordPress 5.6.20
5.6.4
Fixed in WordPress 5.6.20
5.6.3
Fixed in WordPress 5.6.20
5.6.2
Fixed in WordPress 5.6.20
5.6.1
Fixed in WordPress 5.6.20
5.6
Fixed in WordPress 5.6.20
5.5.20
Fixed in WordPress 5.5.21
5.5.19
Fixed in WordPress 5.5.21
5.5.18
Fixed in WordPress 5.5.21
5.5.17
Fixed in WordPress 5.5.21
5.5.16
Fixed in WordPress 5.5.21
5.5.15
Fixed in WordPress 5.5.21
5.5.14
Fixed in WordPress 5.5.21
5.5.13
Fixed in WordPress 5.5.21
5.5.12
Fixed in WordPress 5.5.21
5.5.11
Fixed in WordPress 5.5.21
5.5.10
Fixed in WordPress 5.5.21
5.5.9
Fixed in WordPress 5.5.21
5.5.8
Fixed in WordPress 5.5.21
5.5.7
Fixed in WordPress 5.5.21
5.5.6
Fixed in WordPress 5.5.21
5.5.5
Fixed in WordPress 5.5.21
5.5.4
Fixed in WordPress 5.5.21
5.5.3
Fixed in WordPress 5.5.21
5.5.2
Fixed in WordPress 5.5.21
5.5.1
Fixed in WordPress 5.5.21
5.5
Fixed in WordPress 5.5.21
5.4.21
Fixed in WordPress 5.4.22
5.4.20
Fixed in WordPress 5.4.22
5.4.19
Fixed in WordPress 5.4.22
5.4.18
Fixed in WordPress 5.4.22
5.4.17
Fixed in WordPress 5.4.22
5.4.16
Fixed in WordPress 5.4.22
5.4.15
Fixed in WordPress 5.4.22
5.4.14
Fixed in WordPress 5.4.22
5.4.13
Fixed in WordPress 5.4.22
5.4.12
Fixed in WordPress 5.4.22
5.4.11
Fixed in WordPress 5.4.22
5.4.10
Fixed in WordPress 5.4.22
5.4.9
Fixed in WordPress 5.4.22
5.4.8
Fixed in WordPress 5.4.22
5.4.7
Fixed in WordPress 5.4.22
5.4.6
Fixed in WordPress 5.4.22
5.4.5
Fixed in WordPress 5.4.22
5.4.4
Fixed in WordPress 5.4.22
5.4.3
Fixed in WordPress 5.4.22
5.4.2
Fixed in WordPress 5.4.22
5.4.1
Fixed in WordPress 5.4.22
5.4
Fixed in WordPress 5.4.22
5.3.23
Fixed in WordPress 5.3.24
5.3.22
Fixed in WordPress 5.3.24
5.3.21
Fixed in WordPress 5.3.24
5.3.20
Fixed in WordPress 5.3.24
5.3.19
Fixed in WordPress 5.3.24
5.3.18
Fixed in WordPress 5.3.24
5.3.17
Fixed in WordPress 5.3.24
5.3.16
Fixed in WordPress 5.3.24
5.3.15
Fixed in WordPress 5.3.24
5.3.14
Fixed in WordPress 5.3.24
5.3.13
Fixed in WordPress 5.3.24
5.3.12
Fixed in WordPress 5.3.24
5.3.11
Fixed in WordPress 5.3.24
5.3.10
Fixed in WordPress 5.3.24
5.3.9
Fixed in WordPress 5.3.24
5.3.8
Fixed in WordPress 5.3.24
5.3.7
Fixed in WordPress 5.3.24
5.3.6
Fixed in WordPress 5.3.24
5.3.5
Fixed in WordPress 5.3.24
5.3.4
Fixed in WordPress 5.3.24
5.3.3
Fixed in WordPress 5.3.24
5.3.2
Fixed in WordPress 5.3.24
5.3.1
Fixed in WordPress 5.3.24
5.3
Fixed in WordPress 5.3.24
5.2.26
Fixed in WordPress 5.2.27
5.2.25
Fixed in WordPress 5.2.27
5.2.24
Fixed in WordPress 5.2.27
5.2.23
Fixed in WordPress 5.2.27
5.2.22
Fixed in WordPress 5.2.27
5.2.21
Fixed in WordPress 5.2.27
5.2.20
Fixed in WordPress 5.2.27
5.2.19
Fixed in WordPress 5.2.27
5.2.18
Fixed in WordPress 5.2.27
5.2.17
Fixed in WordPress 5.2.27
5.2.16
Fixed in WordPress 5.2.27
5.2.15
Fixed in WordPress 5.2.27
5.2.14
Fixed in WordPress 5.2.27
5.2.13
Fixed in WordPress 5.2.27
5.2.12
Fixed in WordPress 5.2.27
5.2.11
Fixed in WordPress 5.2.27
5.2.10
Fixed in WordPress 5.2.27
5.2.9
Fixed in WordPress 5.2.27
5.2.8
Fixed in WordPress 5.2.27
5.2.7
Fixed in WordPress 5.2.27
5.2.6
Fixed in WordPress 5.2.27
5.2.5
Fixed in WordPress 5.2.27
5.2.4
Fixed in WordPress 5.2.27
5.2.3
Fixed in WordPress 5.2.27
5.2.2
Fixed in WordPress 5.2.27
5.2.1
Fixed in WordPress 5.2.27
5.2
Fixed in WordPress 5.2.27
5.1.24
Fixed in WordPress 5.1.25
5.1.23
Fixed in WordPress 5.1.25
5.1.22
Fixed in WordPress 5.1.25
5.1.21
Fixed in WordPress 5.1.25
5.1.20
Fixed in WordPress 5.1.25
5.1.19
Fixed in WordPress 5.1.25
5.1.18
Fixed in WordPress 5.1.25
5.1.17
Fixed in WordPress 5.1.25
5.1.16
Fixed in WordPress 5.1.25
5.1.15
Fixed in WordPress 5.1.25
5.1.14
Fixed in WordPress 5.1.25
5.1.13
Fixed in WordPress 5.1.25
5.1.12
Fixed in WordPress 5.1.25
5.1.11
Fixed in WordPress 5.1.25
5.1.10
Fixed in WordPress 5.1.25
5.1.9
Fixed in WordPress 5.1.25
5.1.8
Fixed in WordPress 5.1.25
5.1.7
Fixed in WordPress 5.1.25
5.1.6
Fixed in WordPress 5.1.25
5.1.5
Fixed in WordPress 5.1.25
5.1.4
Fixed in WordPress 5.1.25
5.1.3
Fixed in WordPress 5.1.25
5.1.2
Fixed in WordPress 5.1.25
5.1.1
Fixed in WordPress 5.1.25
5.1
Fixed in WordPress 5.1.25
5.0.27
Fixed in WordPress 5.0.28
5.0.26
Fixed in WordPress 5.0.28
5.0.25
Fixed in WordPress 5.0.28
5.0.24
Fixed in WordPress 5.0.28
5.0.23
Fixed in WordPress 5.0.28
5.0.22
Fixed in WordPress 5.0.28
5.0.21
Fixed in WordPress 5.0.28
5.0.20
Fixed in WordPress 5.0.28
5.0.19
Fixed in WordPress 5.0.28
5.0.18
Fixed in WordPress 5.0.28
5.0.17
Fixed in WordPress 5.0.28
5.0.16
Fixed in WordPress 5.0.28
5.0.15
Fixed in WordPress 5.0.28
5.0.14
Fixed in WordPress 5.0.28
5.0.13
Fixed in WordPress 5.0.28
5.0.12
Fixed in WordPress 5.0.28
5.0.11
Fixed in WordPress 5.0.28
5.0.10
Fixed in WordPress 5.0.28
5.0.9
Fixed in WordPress 5.0.28
5.0.8
Fixed in WordPress 5.0.28
5.0.7
Fixed in WordPress 5.0.28
5.0.6
Fixed in WordPress 5.0.28
5.0.4
Fixed in WordPress 5.0.28
5.0.3
Fixed in WordPress 5.0.28
5.0.2
Fixed in WordPress 5.0.28
5.0.1
Fixed in WordPress 5.0.28
5.0
Fixed in WordPress 5.0.28
4.9.31
Fixed in WordPress 4.9.32
4.9.30
Fixed in WordPress 4.9.32
4.9.29
Fixed in WordPress 4.9.32
4.9.28
Fixed in WordPress 4.9.32
4.9.27
Fixed in WordPress 4.9.32
4.9.26
Fixed in WordPress 4.9.32
4.9.25
Fixed in WordPress 4.9.32
4.9.24
Fixed in WordPress 4.9.32
4.9.23
Fixed in WordPress 4.9.32
4.9.22
Fixed in WordPress 4.9.32
4.9.21
Fixed in WordPress 4.9.32
4.9.20
Fixed in WordPress 4.9.32
4.9.19
Fixed in WordPress 4.9.32
4.9.18
Fixed in WordPress 4.9.32
4.9.17
Fixed in WordPress 4.9.32
4.9.16
Fixed in WordPress 4.9.32
4.9.15
Fixed in WordPress 4.9.32
4.9.14
Fixed in WordPress 4.9.32
4.9.13
Fixed in WordPress 4.9.32
4.9.12
Fixed in WordPress 4.9.32
4.9.11
Fixed in WordPress 4.9.32
4.9.10
Fixed in WordPress 4.9.32
4.9.9
Fixed in WordPress 4.9.32
4.9.8
Fixed in WordPress 4.9.32
4.9.7
Fixed in WordPress 4.9.32
4.9.6
Fixed in WordPress 4.9.32
4.9.5
Fixed in WordPress 4.9.32
4.9.4
Fixed in WordPress 4.9.32
4.9.3
Fixed in WordPress 4.9.32
4.9.2
Fixed in WordPress 4.9.32
4.9.1
Fixed in WordPress 4.9.32
4.9
Fixed in WordPress 4.9.32
4.8.30
Fixed in WordPress 4.8.31
4.8.29
Fixed in WordPress 4.8.31
4.8.28
Fixed in WordPress 4.8.31
4.8.27
Fixed in WordPress 4.8.31
4.8.26
Fixed in WordPress 4.8.31
4.8.25
Fixed in WordPress 4.8.31
4.8.24
Fixed in WordPress 4.8.31
4.8.23
Fixed in WordPress 4.8.31
4.8.22
Fixed in WordPress 4.8.31
4.8.21
Fixed in WordPress 4.8.31
4.8.20
Fixed in WordPress 4.8.31
4.8.19
Fixed in WordPress 4.8.31
4.8.18
Fixed in WordPress 4.8.31
4.8.17
Fixed in WordPress 4.8.31
4.8.16
Fixed in WordPress 4.8.31
4.8.15
Fixed in WordPress 4.8.31
4.8.14
Fixed in WordPress 4.8.31
4.8.13
Fixed in WordPress 4.8.31
4.8.12
Fixed in WordPress 4.8.31
4.8.11
Fixed in WordPress 4.8.31
4.8.10
Fixed in WordPress 4.8.31
4.8.9
Fixed in WordPress 4.8.31
4.8.8
Fixed in WordPress 4.8.31
4.8.7
Fixed in WordPress 4.8.31
4.8.6
Fixed in WordPress 4.8.31
4.8.5
Fixed in WordPress 4.8.31
4.8.4
Fixed in WordPress 4.8.31
4.8.3
Fixed in WordPress 4.8.31
4.8.2
Fixed in WordPress 4.8.31
4.8.1
Fixed in WordPress 4.8.31
4.8
Fixed in WordPress 4.8.31

References

URL
https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
paulos__
Verified
Yes
WPVDB ID
2624e094-6c88-43b4-812f-26444994737d

Timeline

Publicly Published
2026-09-17 (about 22 days ago)
Added
2026-09-18 (about 21 days ago)
Last Updated
2026-09-18 (about 21 days ago)

Other

Published
Title
Published
2025-04-18
Title
Grand Restaurant WordPress <= 7.0 - Cross-Site Request Forgery
Published
2022-11-08
Title
3DPrint < 3.5.6.9 - Arbitrary File and Directory Deletion via CSRF
Published
2024-11-01
Title
MDR Webmaster Tools <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-08-20
Title
ads.txt Guru Connect < 1.1.2 - Cross-Site Request Forgery
Published
2025-04-09
Title
Spoiler Block <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting