A Cross-Site Request Forgery vulnerability in the ApusListing WordPress theme allows unauthenticated attackers to potentially bypass authentication, requiring an immediate update to version 1.2.64.

This is a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352) that does not require prior authentication from the attacker. It allows an attacker to perform unauthorized actions on behalf of a victim user.

The CVSS score of 8.8 reflects the high risk of this vulnerability. Successful exploitation could lead to unauthorized administrative actions, including the potential for broken authentication, which severely compromises the security posture of the WordPress site and any user data managed within it.

Immediate Action: Update the ApusListing theme to the latest available version, at least 1.2.64, through the WordPress dashboard or the vendor's site.

Proactive Monitoring: Monitor WordPress user logs for irregular administrative actions or unexpected changes to user roles and configurations.

Compensating Controls: Use a Web Application Firewall (WAF) to filter malicious requests and ensure that anti-CSRF tokens are strictly enforced across all theme functions.

Public Exploit Available: No (exploit_available: unknown)

Users of the ApusListing theme must prioritize updating to version 1.2.64 to close the identified security gap. Failure to do so leaves the WordPress installation exposed to unauthorized actions that could result in full administrative account takeover.