CVE-2023-49838

MEDIUM

KlbTheme Clotya, Cosmetsy, Furnob, Bacola, Partdo, Medibazar, Machic themes - Cross-Site Request Forgery

Title source: llm

Description

Cross-Site Request Forgery (CSRF) vulnerability in KlbTheme Clotya theme, KlbTheme Cosmetsy theme, KlbTheme Furnob theme, KlbTheme Bacola theme, KlbTheme Partdo theme, KlbTheme Medibazar theme, KlbTheme Machic theme.This issue affects Clotya theme: from n/a through 1.1.6; Cosmetsy theme: from n/a through 1.7.7; Furnob theme: from n/a through 1.2.2; Bacola theme: from n/a through 1.3.3; Partdo theme: from n/a through 1.1.1; Medibazar theme: from n/a through 1.8.6; Machic theme: from n/a through 1.2.8.

References (7)

Core 7

Core References

Third Party Advisory vdb-entry

https://patchstack.com/database/vulnerability/clotya/wordpress-clotya-theme-1-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

Third Party Advisory vdb-entry

https://patchstack.com/database/vulnerability/cosmetsy/wordpress-cosmetsy-theme-1-7-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

Third Party Advisory vdb-entry

https://patchstack.com/database/vulnerability/furnob/wordpress-furnob-theme-1-2-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

Third Party Advisory vdb-entry

https://patchstack.com/database/vulnerability/bacola/wordpress-bacola-theme-1-3-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

Third Party Advisory vdb-entry

https://patchstack.com/database/vulnerability/partdo/wordpress-partdo-theme-1-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

Third Party Advisory vdb-entry

https://patchstack.com/database/vulnerability/medibazar/wordpress-medibazar-theme-1-8-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

Third Party Advisory vdb-entry

https://patchstack.com/database/vulnerability/machic/wordpress-machic-theme-1-2-8-cross-site-request-forgery-csrf-vulnerability?_s_id=cve

Scores

CVSS v3 4.3

EPSS 0.0026

EPSS Percentile 17.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-352

Status published

Products (7)

KlbTheme/Bacola theme < 1.3.3

KlbTheme/Clotya theme < 1.1.6

KlbTheme/Cosmetsy theme < 1.7.7

KlbTheme/Furnob theme < 1.2.2

KlbTheme/Machic theme < 1.2.8

KlbTheme/Medibazar theme < 1.8.6

KlbTheme/Partdo theme < 1.1.1

Published Mar 26, 2024

Tracked Since Feb 18, 2026