WordPress before 5.5.2 allows CSRF attacks that change a theme's background image.
{ "cpes": [ "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*" ], "severity": "Medium" }