Junglewise Threat Intelligence

CVE-2026-81432: JetStyleManager for Gutenberg CSRF via unprotected AJAX actions

CVE-2026-81432 · Severity: medium · CVSS 4.3 · Published 2026-09-02

Vendors: Crocoblock.

Executive brief

JetStyleManager for Gutenberg is a WordPress plugin that manages custom widget styling within the Gutenberg block editor. The plugin fails to validate cross-site request forgery (CSRF) tokens on certain AJAX actions, allowing an attacker to trick a logged-in editor or administrator into deleting or modifying custom widget skins by clicking a malicious link. This could disrupt site design and styling.

Technical details

The vulnerability is a cross-site request forgery (CSRF) flaw affecting AJAX handlers for widget skin management, specifically the `jet_sm_delete_skin` and `jet_sm_save_skin` actions. The plugin accepts POST requests to these endpoints without validating a nonce token, allowing attackers to craft malicious HTML pages that execute authenticated requests in the victim's browser context. An attacker must trick a victim with Contributor-level or higher permissions (edit_posts capability) into visiting a malicious page; the victim's existing WordPress session cookie is automatically included, enabling silent deletion or modification of custom widget skins. The issue was patched in version 1.3.9.

Affected products

  • Crocoblock JetStyleManager for Gutenberg before 1.3.9

Timeline

  • 2026-08-31: disclosed
  • 2026-08-31: patched: Fixed in version 1.3.9

References