CVE-2026-32344: 
WordPress vulnerability analysis and mitigation

CVE-2026-32344 is a Cross-Site Request Forgery (CSRF) vulnerability in the Corpiva WordPress theme developed by desertthemes. It affects all versions of the Corpiva theme up to and including version 1.0.96, and was discovered by researcher Trương Hữu Phúc (truonghuuphuc) and reported on January 12, 2026, with public disclosure on February 11, 2026 via Patchstack. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), arising from insufficient or absent CSRF token validation in the Corpiva WordPress theme. An unauthenticated attacker can craft a malicious web page or link that, when visited by an authenticated privileged user (e.g., a WordPress administrator), causes the victim's browser to submit unauthorized requests to the WordPress site on their behalf. Exploitation requires user interaction — specifically, a privileged user must be tricked into clicking a malicious link or visiting a crafted page while authenticated (Patchstack).

Successful exploitation allows a malicious actor to force higher-privileged users (such as site administrators) to execute unwanted actions on the WordPress site without their knowledge or consent. The primary impact is on integrity — an attacker could trigger unauthorized configuration changes, content modifications, or administrative actions. Confidentiality and availability are not directly impacted according to the CVSS assessment (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-32344. The EPSS score is extremely low at approximately 0.008%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, though this specific vulnerability is rated low priority (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Corpiva theme version 1.0.96 or earlier, using tools like WPScan or by inspecting page source for theme metadata.
2. Craft malicious request: Identify a sensitive state-changing action within the Corpiva theme (e.g., a settings update form) that lacks CSRF token validation.
3. Create malicious page: Build an HTML page containing a hidden form or auto-submitting JavaScript that sends a forged POST/GET request to the target WordPress site's vulnerable endpoint, mimicking the legitimate action.
4. Social engineering: Deliver the malicious link or page to a privileged WordPress user (e.g., administrator) via phishing email, comment, or other channel.
5. Trigger exploitation: When the authenticated victim visits the malicious page, their browser automatically submits the forged request with their session credentials, causing the unauthorized action to execute on the WordPress site (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to theme-related admin endpoints from unusual referrer URLs or with no valid referrer header.
• Logs: Admin action logs (if enabled via audit plugins) recording configuration changes or content modifications that the administrator does not recall performing.
• Network: Requests to WordPress admin endpoints originating from external or unexpected referrer domains, particularly those associated with CSRF delivery pages.

The vulnerability is patched in Corpiva theme version 1.0.97. Site owners should update the Corpiva theme to version 1.0.97 or later immediately. If an immediate update is not possible, site administrators should avoid clicking on unsolicited links while logged into the WordPress admin panel, and consider using a WordPress security plugin (such as Patchstack) that provides virtual patching capabilities (Patchstack).