CVE-2026-39640

CVE-2026-39640 is a Cross-Site Request Forgery vulnerability in the mndpsingh287 Theme Editor WordPress theme (versions 3.2 and earlier) that enables code injection attacks. The flaw allows unauthenticated attackers to exploit social engineering tactics to execute arbitrary code within affected installations. The vulnerability carries a CRITICAL severity rating (CVSS 9.6) with a network-based attack vector requiring minimal complexity and user interaction, but potentially compromising confidentiality, integrity, and availability across system boundaries. The exposure is particularly concerning due to the absence of authentication requirements. Current exploitation status indicates no active real-world exploitation documented in known exploit databases or vulnerability tracking lists. The EPSS score of 0.000190000 suggests minimal probability of exploitation in the near term, and the vulnerability remains inactive on threat intelligence hotlists, indicating limited community attention and threat actor interest at this time. However, the critical CVSS rating warrants prompt patching before widespread awareness develops.