Core theme not patched for latest SMF security fixes.
In index.tempate.php file
<input type="hidden" name="hash_passwrd" value="" />
should be replaced with
<input type="hidden" name="hash_passwrd" value="" /><input type="hidden" name="', $context['session_var'], '" value="', $context['session_id'], '" />
It's also missing in 2.0.15 large upgrade package.
Core is not really relevant or supported any more, either....
I've worked on several forums that are currently using Core, or customizations thereof. If it's no longer being supported, it should be removed. This was a minor fix of a well known problem, there's really no excuse that it wasn't applied to Core.
Quote from: Kindred on December 25, 2017, 12:30:56 PM
Core is not really relevant or supported any more, either....
Was mentioned back when 2.0.14 was released, https://www.simplemachines.org/community/index.php?topic=555856.msg3939909#msg3939909
Now wondering why it's still packaged with SMF, if it doesn't work and goes unsupported.
There were a number of places that were broken by the security patch. The mod I submitted recently should help though (nudge nudge)