medium4.3
CVE-2025-10684
The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, …
Impact
The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary .
Affected products
| Product | Affected versions |
|---|---|
| Construction Light WordPress Theme | before 1.6.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.