WordPress KALLYAS テーマ < 4.25.0 - クロスサイトリクエストフォージェリ (CSRF) 脆弱性

This CSRF vulnerability allows an attacker to trick a legitimate user into performing actions they did not intend to. For example, an attacker could craft a malicious link that, when clicked by an authenticated user, modifies theme settings, adds or deletes pages, or performs other administrative tasks. The blast radius is limited to the user's privileges within the WordPress site; however, if the user has administrative access, the impact can be significant, potentially leading to complete site compromise. Successful exploitation requires the user to be logged in and interact with the malicious link.

Websites using the KALLYAS WordPress theme, particularly those running versions 0.0.0 through 4.25.0, are at risk. Shared hosting environments where users have limited control over theme updates are especially vulnerable. Sites with administrative users who frequently click on links from untrusted sources are also at higher risk.

• wordpress / composer / npm:

grep -r 'kallyas_theme_options' /var/www/html/*

• wordpress / composer / npm:

wp plugin list | grep kallyas

• wordpress / composer / npm:

wp plugin update kallyas

1. 2025-12-09Disclosure

   disclosure

1. 予約済み2025-10-24
2. 公開日2025-12-09
3. 更新日2026-04-28
4. EPSS 更新日2026-03-23

The primary mitigation is to upgrade the KALLYAS WordPress theme to version 4.25.0 or later. If immediate upgrading is not possible due to compatibility issues or breaking changes, consider implementing strict Content Security Policy (CSP) headers to restrict the origin of scripts and resources. Additionally, implement server-side CSRF tokens for sensitive actions within the theme. While not a direct fix, these measures can reduce the attack surface. After upgrading, verify the theme's functionality and ensure no unexpected behavior arises.