A CSRF vulnerability in the Frenify Mow WordPress theme allows an attacker to perform unauthorized code injection, potentially leading to full site compromise.

The theme is susceptible to Cross-Site Request Forgery (CWE-352), which allows an attacker to trick an authenticated administrator into executing malicious actions, resulting in code injection.

While the CVSS score is 9.6, the requirement for user interaction (UI:R) slightly modifies the attack vector. However, successful exploitation can result in full administrative control over the WordPress instance, leading to data breaches, site defacement, or the installation of malicious backdoors.

Immediate Action: Update the Frenify Mow theme to version 4.11 or higher immediately to resolve the vulnerability.

Proactive Monitoring: Review WordPress administrative logs for unauthorized changes to theme files or suspicious plugin/user activity that could indicate a CSRF-based compromise.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious CSRF attempts and enforce strict administrative access policies for the WordPress dashboard.

Public Exploit Available: No (unknown)

Administrators should treat this vulnerability with high urgency and apply the update to version 4.11 immediately. Ensuring that administrative sessions are secure and that users are educated on the risks of clicking suspicious links while logged into the site will provide additional defense-in-depth.