Executive brief
JetStyleManager for Gutenberg is a WordPress plugin that manages custom widget styling within the Gutenberg block editor. The plugin fails to validate cross-site request forgery (CSRF) tokens on certain AJAX actions, allowing an attacker to trick a logged-in editor or administrator into deleting or modifying custom widget skins by clicking a malicious link. This could disrupt site design and styling.
Technical details
The vulnerability is a cross-site request forgery (CSRF) flaw affecting AJAX handlers for widget skin management, specifically the `jet_sm_delete_skin` and `jet_sm_save_skin` actions. The plugin accepts POST requests to these endpoints without validating a nonce token, allowing attackers to craft malicious HTML pages that execute authenticated requests in the victim's browser context. An attacker must trick a victim with Contributor-level or higher permissions (edit_posts capability) into visiting a malicious page; the victim's existing WordPress session cookie is automatically included, enabling silent deletion or modification of custom widget skins. The issue was patched in version 1.3.9.
Affected products
- Crocoblock JetStyleManager for Gutenberg before 1.3.9
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in version 1.3.9