CVE-2026-22342: WordPress WordPress Dating Theme theme <= 11.2.0 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability

Synopsis

A Cross-Site Request Forgery (CSRF) vulnerability affects the WordPress Dating Theme plugin by PremiumPress Limited at version 11.2.0 and earlier. The flaw is reachable over the network and requires no authentication from the attacker, but does require a victim to interact with a malicious link or page. Successful exploitation allows a remote attacker to perform account takeover, with high impact to confidentiality, integrity, and availability of the affected WordPress installation. No fix version has been published yet; HarborGuard tracks the advisory and will surface a patched rebuild the moment upstream ships one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target WordPress site over the network; the vulnerable endpoint is exposed via standard HTTP/HTTPS.

• AuthenticationNot required

  No account or credentials are needed on the target site; the attack is launched entirely from an unauthenticated position.

• Victim interactionRequired

  A logged-in WordPress user must be socially engineered into visiting a malicious page or clicking a crafted link that triggers the forged request.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim interacts; no race conditions, special memory layout, or environmental factors are required.

Blast Radius

• A successful attack allows the attacker to take over the victim's WordPress account, gaining full control of the account's session and permissions.
• With high integrity impact, the attacker can modify persisted site content, user data, and plugin or theme settings under the victim's identity.
• With high confidentiality impact, the attacker can read stored user profile data, private messages, and any session credentials accessible to the compromised account.
• With high availability impact, the attacker can disrupt or disable site functionality by altering or deleting configuration and content through the hijacked account.