Description

The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the edit_posts capability (Contributor and above) delete or modify custom widget skins via a crafted request, provided they can trick the user into performing an action such as clicking a link.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-02T06:17:19.473Z",
  "pubdate": "2026-09-02T06:17:19.473Z",
  "executiveSummary": "The JetStyleManager for Gutenberg plugin prior to version 1.3.9 is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability.\nThis flaw stems from a lack of nonce verification or equivalent CSRF protection mechanisms within critical AJAX action handlers.\nAn attacker can exploit this by tricking an authenticated user with the 'edit_posts' capability into executing a malicious request, which is then processed by the application with the user's elevated permissions.\nThe impact includes the unauthorized deletion or modification of custom widget skins, potentially leading to visual defacement, loss of site configuration integrity, or indirect security degradation.\nThe vulnerability requires social engineering to succeed, as the victim must interact with a crafted link or resource while logged into the WordPress administrative interface.\nThe attack is limited by the victim's permission level but remains a significant threat to sites where contributors or higher-privileged users frequently interact with administrative dashboards.",
  "technicalDetails": "The root cause of this vulnerability is the absence of secure nonces in the AJAX request handling logic within the JetStyleManager plugin. WordPress utilizes nonces—unique, one-time-use tokens—to ensure that requests originate from a trusted user interface and not an external source.\nBecause these AJAX actions lack server-side validation for such tokens, the plugin incorrectly trusts the incoming HTTP request if the target user has an active session and the requisite 'edit_posts' capability.\nThe attack flow begins when an attacker crafts a malicious web page or email containing a link or an auto-submitting form targeting the plugin's vulnerable AJAX endpoint. When an authenticated user—such as a Contributor, Author, or Editor—visits the attacker-controlled resource, the user's browser automatically appends the relevant authentication cookies to the crafted request sent to the target WordPress site.\nUpon receiving the request, the server identifies the session as authenticated and, due to the missing nonce check, proceeds to execute the requested action. This allows the attacker to perform administrative functions on behalf of the user, such as 'delete_skin' or 'update_skin' operations.\nSpecifically, the plugin fails to implement the check_ajax_referer() function or verify current_user_can() against specific nonces within the backend hook associated with widget skin management. Consequently, any request that reaches the backend logic with the correct parameters will be executed blindly.\nThe exploitation is successful even if the attacker does not have direct access to the WordPress administrative dashboard, as the 'Cross-Site' nature of the attack leverages the victim's established session to bypass authorization boundaries.\nPost-exploitation, the attacker can manipulate custom skins defined within JetStyleManager. While this primarily impacts the frontend appearance and CSS definitions, it could theoretically be chained with other vulnerabilities if the modification of skins allows for the injection of malicious JavaScript or CSS, potentially leading to persistent Cross-Site Scripting (XSS) if the system fails to sanitize the input properly during the skin saving process.\nThe vulnerability is present in all versions prior to 1.3.9. Users possessing the 'edit_posts' capability act as the primary vector, meaning the attack surface is proportional to the number of users with these editorial permissions."
}