Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme

Description

The plugin does not perform any capability or nonce check on the action that creates and activates its bundled child theme, allowing any authenticated user such as a subscriber to switch the site's active theme site-wide, and allowing the same action to be triggered against any logged-in user including an administrator via CSRF.