{"id":"CVE-2026-125838","kind":"vulnerability","aliases":["CVE-2026-125838"],"related":[],"title":"Quality theme by webriti: cross-site request forgery lets attackers act as admins","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti Quality quality allows Cross Site Request Forgery.This issue affects Quality: from n/a through 3.3.","summary":"The webriti Quality product has a cross-site request forgery flaw affecting versions up to and including 3.3. A malicious web page can make a logged-in user's browser send unwanted requests to the product.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"webriti Quality","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","webriti-quality"],"not_affected_if":["not-installed"],"how_to_check":"- Check the installed Quality version in the product's admin or stylesheet header against `3.3`","fix":"- Quality: unknown (sources do not name a fixed version)","status":"open","published_at":"2026-11-11T14:17:35+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","triaged_at":"2026-11-11T14:29:19+00:00","updated_at":"2026-11-11T14:29:19+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-11T14:29:19Z","model":"claude-haiku-5-5","output":{"fix":"- Quality: unknown (sources do not name a fixed version)","reach":"internet","title":"Quality theme by webriti: cross-site request forgery lets attackers act as admins","impact":"medium","summary":"The webriti Quality product has a cross-site request forgery flaw affecting versions up to and including 3.3. A malicious web page can make a logged-in user's browser send unwanted requests to the product.","audience":"businesses","category":"other","nicknames":[],"who_cares":["webriti-quality"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker triggers privileged actions in a logged-in user's session","analyst_note":"Confirm the fixed version and the affected product type (WordPress theme or other) at https://nvd.nist.gov/vuln/detail/CVE-2026-125838 and the vendor's advisory.","how_to_check":"- Check the installed Quality version in the product's admin or stylesheet header against `3.3`\n- unknown","plain_action":"","product_name":"webriti Quality","needs_analyst":true,"not_affected_if":["not-installed"],"who_is_affected":"Sites running the webriti Quality product at version 3.3 or earlier are in scope according to the NVD description. The sources do not say which configuration or role is needed, so the exposed surface is unknown. Teams not running this product can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000716,"input_tokens":4528,"output_tokens":527,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125838':17A,20A '-2026':16A,19A '3.3':45B,87C 'act':12A 'admin':14A 'affect':39B,82C 'allow':76C 'attack':11A 'browser':58B 'cross':6A,34B,66C,77C 'cross-sit':5A,33B,65C 'csrf':70C 'cve':15A,18A 'flaw':38B 'forgeri':9A,37B,69C 'forgery.this':80C 'includ':44B 'issu':81C 'let':10A 'log':54B 'logged-in':53B 'make':51B 'malici':47B 'n/a':85C 'page':49B 'product':30B,64B 'qualiti':1A,26B,29B,74C,75C,83C 'quality':22A 'request':8A,36B,61B,68C,79C 'send':59B 'site':7A,35B,67C,78C 'theme':2A 'unwant':60B 'user':56B 'version':40B 'vulner':71C 'web':48B 'webriti':4A,21A,25B,28B,73C 'webriti-qu':24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the webriti Quality product at version 3.3 or earlier are in scope according to the NVD description. The sources do not say which configuration or role is needed, so the exposed surface is unknown. Teams not running this product can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["quality","webritiquality"],"ptokens":["quality","webriti"],"labels":["high","other","vendor","webritiquality"],"campaign_type":null,"search_a":"'-125838':17A,20A '-2026':16A,19A 'act':12A 'admin':14A 'attack':11A 'cross':6A 'cross-sit':5A 'cve':15A,18A 'forgeri':9A 'let':10A 'qualiti':1A 'quality':22A 'request':8A 'site':7A 'theme':2A 'webriti':4A,21A","search_b":"'3.3':45B 'affect':39B 'browser':58B 'cross':34B 'cross-sit':33B 'flaw':38B 'forgeri':37B 'includ':44B 'log':54B 'logged-in':53B 'make':51B 'malici':47B 'page':49B 'product':30B,64B 'qualiti':26B,29B 'request':36B,61B 'send':59B 'site':35B 'unwant':60B 'user':56B 'version':40B 'web':48B 'webriti':25B,28B 'webriti-qu':24B","search_c":"'3.3':87C 'affect':82C 'allow':76C 'cross':66C,77C 'cross-sit':65C 'csrf':70C 'forgeri':69C 'forgery.this':80C 'issu':81C 'n/a':85C 'qualiti':74C,75C,83C 'request':68C,79C 'site':67C,78C 'vulner':71C 'webriti':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T14:17:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125838","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125838","severity":null,"published_at":"2026-11-11T14:17:35+00:00","modified_at":"2026-11-11T14:17:35+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","fetched_at":"2026-11-11T14:27:31+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}