{"id":"CVE-2026-125839","kind":"vulnerability","aliases":["CVE-2026-125839"],"related":[],"title":"ElitePress WordPress theme: cross-site request forgery lets attackers act as admins","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti ElitePress elitepress allows Cross Site Request Forgery.This issue affects ElitePress: from n/a through 3.2.1.","summary":"ElitePress (a WordPress theme by webriti) has a cross-site request forgery flaw affecting versions through 3.2.1. A logged-in administrator who visits a malicious page could be tricked into performing actions on the site without knowing.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ElitePress","fixed":[],"affected":"<= 3.2.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["csrf","elitepress","no-fix","package","webriti","wordpress","wordpress-theme"],"not_affected_if":["theme-not-installed"],"how_to_check":"- In WordPress admin go to Appearance > Themes, or read the Version line in wp-content/themes/elitepress/style.css. Version 3.2.1 or earlier is affected.\n- Sites with other themes active but ElitePress still installed: check too, and delete it if unused.\n- Which admin actions are forgeable is not published; Patchstack lists only 'CSRF <= 3.2.1'.","fix":"No patched version published as of 2026-11-11: the latest release on wordpress.org is 3.2.1, which is the affected version. Switch theme or remove it if unused until webriti ships a fix.","status":"open","published_at":"2026-11-11T14:17:35+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","triaged_at":"2026-11-11T14:29:17+00:00","updated_at":"2026-11-11T14:32:47+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T14:29:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ElitePress WordPress theme: cross-site request forgery lets attackers act as admins","impact":"high","summary":"ElitePress (a WordPress theme by webriti) has a cross-site request forgery flaw affecting versions through 3.2.1. A logged-in administrator who visits a malicious page could be tricked into performing actions on the site without knowing.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elitepress","webriti"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker performs administrator actions on the WordPress site","analyst_note":"Confirm the fixed version and the vulnerable actions from the NVD or the webriti/WPScan advisory pages, since the sources here give only 'through 3.2.1'.","how_to_check":"- Check the installed ElitePress theme version in the WordPress admin under Appearance > Themes, or in `style.css` of the theme folder.\n- Confirm whether the site runs ElitePress at all.","plain_action":"","product_name":"ElitePress","needs_analyst":true,"not_affected_if":["theme-not-installed"],"who_is_affected":"Sites running the ElitePress theme version 3.2.1 or earlier are affected. The flaw needs a logged-in administrator to visit an attacker-controlled page, so sites that do not use ElitePress can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00073,"input_tokens":4534,"output_tokens":553,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the vulnerable actions from the NVD or the webriti/WPScan advisory pages, since the sources here give only 'through 3.2.1'.","search":"'-125839':16A,19A '-2026':15A,18A '3.2.1':49B,93C 'act':11A 'action':65B 'admin':13A 'administr':54B 'affect':46B,88C 'allow':82C 'attack':10A 'could':60B 'cross':5A,41B,72C,83C 'cross-sit':4A,40B,71C 'csrf':21B,76C 'cve':14A,17A 'elitepress':1A,20A,22B,32B,80C,81C,89C 'fix':25B 'flaw':45B 'forgeri':8A,44B,75C 'forgery.this':86C 'issu':87C 'know':70B 'let':9A 'log':52B 'logged-in':51B 'malici':58B 'n/a':91C 'no-fix':23B 'packag':26B 'page':59B 'perform':64B 'request':7A,43B,74C,85C 'site':6A,42B,68B,73C,84C 'theme':3A,31B,35B 'trick':62B 'version':47B 'visit':56B 'vulner':77C 'webriti':27B,37B,79C 'without':69B 'wordpress':2A,28B,30B,34B 'wordpress-them':29B","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site with the ElitePress theme (by webriti, about 700 active installs) at version 3.2.1 or earlier, which is every release today. An attacker needs a logged-in administrator to visit a malicious page. Sites that do not have ElitePress installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["elitepress"],"ptokens":["elitepress"],"labels":["csrf","elitepress","high","nofix","package","vendor","webriti","wordpress","wordpresstheme"],"campaign_type":null,"search_a":"'-125839':16A,19A '-2026':15A,18A 'act':11A 'admin':13A 'attack':10A 'cross':5A 'cross-sit':4A 'cve':14A,17A 'elitepress':1A,20A 'forgeri':8A 'let':9A 'request':7A 'site':6A 'theme':3A 'wordpress':2A","search_b":"'3.2.1':49B 'action':65B 'administr':54B 'affect':46B 'could':60B 'cross':41B 'cross-sit':40B 'csrf':21B 'elitepress':22B,32B 'fix':25B 'flaw':45B 'forgeri':44B 'know':70B 'log':52B 'logged-in':51B 'malici':58B 'no-fix':23B 'packag':26B 'page':59B 'perform':64B 'request':43B 'site':42B,68B 'theme':31B,35B 'trick':62B 'version':47B 'visit':56B 'webriti':27B,37B 'without':69B 'wordpress':28B,30B,34B 'wordpress-them':29B","search_c":"'3.2.1':93C 'affect':88C 'allow':82C 'cross':72C,83C 'cross-sit':71C 'csrf':76C 'elitepress':80C,81C,89C 'forgeri':75C 'forgery.this':86C 'issu':87C 'n/a':91C 'request':74C,85C 'site':73C,84C 'vulner':77C 'webriti':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T14:17:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125839","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125839","severity":null,"published_at":"2026-11-11T14:17:35+00:00","modified_at":"2026-11-11T14:17:35+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","fetched_at":"2026-11-11T14:27:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125839:3558","url":"https://patchstack.com/database/wordpress/theme/elitepress","severity":null,"published_at":"2026-11-11T14:32:47+00:00","modified_at":"2026-11-11T14:32:47+00:00","first_seen_at":"2026-11-11T14:32:47+00:00","fetched_at":"2026-11-11T14:32:47+00:00","note":"NVD page unreadable via web-cli; Patchstack lists CSRF <= 3.2.1, 0 patched; wordpress.org shows latest release is 3.2.1 (updated 2026-06-18), so no fixed version found. Vulnerable actions not published. Nothing verified (no vendor advisory). X/search not used.","cites":["https://patchstack.com/database/wordpress/theme/elitepress","https://wordpress.org/themes/elitepress/"]}],"documents":[{"id":126246,"url":"https://patchstack.com/database/wordpress/theme/elitepress","title":"ElitePress Vulnerabilities - Patchstack","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":126247,"url":"https://wordpress.org/themes/elitepress/","title":"ElitePress - WordPress.org theme page (latest 3.2.1)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}