Report
Several themes for WordPress are vulnerable to Cross-Site Request Forgery due to missing nonce validation on the activate_plugin() function called via an AJAX action in various versions of the themes. This makes it possible for unauthenticated attackers to activate arbitrary plugins via a forged request, if they can trick an authenticated user into performing an action such as clicking on a link.
Score:4.3
Severity:Medium
Version: 1.4.5
There is a patch available in v1.4.6 and we strongly recommend you update to this version as soon as possible.
