CVE-2026-81432: JetStyleManager < 1.3.9 - Skin Deletion and Modification via CSRF
The JetStyleManager for Gutenberg WordPress plugin before 1.3.9 does not have CSRF protection on some of its AJAX actions, allowing attackers to make a logged-in user with the editposts capability (Contributor and above) delete or modify custom widget skins via a crafted request, provided they can trick the user into performing an action such as clicking a link.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using JetStyleManager for Gutenberg versions before 1.3.9 are affected if a logged-in user has the edit_posts capability. This includes Contributor-level users and higher.
What must an attacker do to exploit it?
The attacker must trick an authenticated user with edit_posts capability into performing an action, such as clicking a crafted link. The vulnerable AJAX actions can then be used to delete or modify custom widget skins in that user's browser session.
Are unauthenticated visitors able to exploit this directly?
No. Exploitation requires a logged-in WordPress user with the edit_posts capability, so the issue depends on cross-site request forgery against an authenticated user.