---
id: "CVE-2026-125839"
page: "https://infrastack.ai/live/CVE-2026-125839"
kind: "vulnerability"
aliases: ["CVE-2026-125839"]
title: "ElitePress WordPress theme: cross-site request forgery lets attackers act as admins"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ElitePress", "fixed": [], "affected": "<= 3.2.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["csrf", "elitepress", "no-fix", "package", "webriti", "wordpress", "wordpress-theme"]
not_affected_if: ["theme-not-installed"]
published_at: "2026-11-11T14:17:35+00:00"
first_seen_at: "2026-11-11T14:27:31+00:00"
updated_at: "2026-11-11T14:32:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125839", "first_seen_at": "2026-11-11T14:27:31+00:00"}, {"source": "analyst", "url": "https://patchstack.com/database/wordpress/theme/elitepress", "first_seen_at": "2026-11-11T14:32:47+00:00", "cites": ["https://patchstack.com/database/wordpress/theme/elitepress", "https://wordpress.org/themes/elitepress/"]}]
exploit_sources: []
---

# ElitePress WordPress theme: cross-site request forgery lets attackers act as admins

Link for people: https://infrastack.ai/live/CVE-2026-125839 (this .md is for agents)

ElitePress (a WordPress theme by webriti) has a cross-site request forgery flaw affecting versions through 3.2.1. A logged-in administrator who visits a malicious page could be tricked into performing actions on the site without knowing.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:ElitePress affected <= 3.2.1 fixed no fixed version listed

## How to check

- In WordPress admin go to Appearance > Themes, or read the Version line in wp-content/themes/elitepress/style.css. Version 3.2.1 or earlier is affected.
- Sites with other themes active but ElitePress still installed: check too, and delete it if unused.
- Which admin actions are forgeable is not published; Patchstack lists only 'CSRF <= 3.2.1'.

## Fix

No patched version published as of 2026-11-11: the latest release on wordpress.org is 3.2.1, which is the affected version. Switch theme or remove it if unused until webriti ships a fix.

## Timeline

- 2026-11-11T14:27:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125839
- 2026-11-11T14:32:47+00:00 analyst https://patchstack.com/database/wordpress/theme/elitepress — NVD page unreadable via web-cli; Patchstack lists CSRF <= 3.2.1, 0 patched; wordpress.org shows latest release is 3.2.1 (updated 2026-06-18), so no fixed version found. Vulnerable actions not published. Nothing verified (no vendor advisory). X/search not used.

## Documents

- [advisory] ElitePress Vulnerabilities - Patchstack https://patchstack.com/database/wordpress/theme/elitepress
- [describes] ElitePress - WordPress.org theme page (latest 3.2.1) https://wordpress.org/themes/elitepress/

## From the sources

Cross-Site Request Forgery (CSRF) vulnerability in webriti ElitePress elitepress allows Cross Site Request Forgery.This issue affects ElitePress: from n/a through 3.2.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_