WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Cross Site Request Forgery (CSRF) vulnerability

A successful CSRF attack could allow an attacker to modify user profiles, change settings, or perform other actions as the logged-in user without their knowledge or consent. The impact is particularly severe if the plugin has administrative privileges or handles sensitive data. Attackers could craft malicious links or embed them in emails or websites to trick users into triggering these actions. The blast radius extends to any user of the affected plugin, especially those with elevated privileges.

Websites using the RT-Theme 18 | Extensions plugin, particularly those with user accounts and sensitive data, are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise on one site could potentially affect others.

• wordpress / composer / npm:

grep -r 'stmcan RT-Theme 18 | Extensions' /var/www/html/
wp plugin list | grep rt18-extensions

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/rt18-extensions/ | grep -i 'rt18-extensions'

1. 2026-04-08Disclosure

   disclosure

1. Reserviert2026-04-07
2. Veröffentlicht2026-04-08
3. Geändert2026-04-29
4. EPSS aktualisiert2026-04-15

The primary mitigation is to upgrade the RT-Theme 18 | Extensions plugin to version 2.5.4 or later. If upgrading immediately is not possible, consider implementing temporary workarounds such as adding CSRF tokens to all sensitive forms and actions within the plugin. Web Application Firewalls (WAFs) can also be configured to filter out malicious requests based on patterns associated with CSRF attacks. After upgrading, confirm the vulnerability is resolved by attempting to trigger a sensitive action via a crafted URL and verifying that it fails.