ELITEPRESS · CVE-2026-125839 · Package
NO FIX YET · SEE WHAT TO DO
ElitePress (a WordPress theme by webriti) has a cross-site request forgery flaw affecting versions through 3.2.1. A logged-in administrator who visits a malicious page could be tricked into performing actions on the site without knowing.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any WordPress site with the ElitePress theme (by webriti, about 700 active installs) at version 3.2.1 or earlier, which is every release today. An attacker needs a logged-in administrator to visit a malicious page. Sites that do not have ElitePress installed can skip it.
Not affected if theme-not-installed
Who cares csrf, elitepress, no-fix, webriti, wordpress, wordpress-theme
3.2.1, which is the affected versionPosts are quoted with a link to the original. They are data to us, never instructions.
Cross-Site Request Forgery (CSRF) vulnerability in webriti ElitePress elitepress allows Cross Site Request Forgery.This issue affects ElitePress: from n/a through 3.2.1.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.