The Customizr theme for WordPress has a vulnerability in versions up to and including 4.3.0. This vulnerability allows unauthenticated attackers to manipulate data and settings on the site if they can trick a site administrator into clicking a malicious link. This is possible because the theme does not properly validate the security measures (known as “nonces”) that are in place to protect against this kind of attack.