RAMBO · CVE-2026-125840 · Other
NO FIX YET · SEE WHAT TO DO
Rambo is a WordPress theme by webriti. Versions up to and including 3.0 have a cross-site request forgery flaw (CVSS 8.8). An attacker who lures a logged-in user, such as an admin, to a malicious page can make their session perform actions without their knowledge. The affected actions are not named in the sources.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
The NVD entry describes Rambo from n/a through 3.0 as affected; the sources do not say what Rambo is used for or which configurations are exposed. Teams running Rambo at or below 3.0 should review it. unknown whether a newer fixed version exists.
Not affected if not-wordpress, theme-not-installed, version-above-3.0
Who cares csrf, rambo, webriti, wordpress, wordpress-theme
Posts are quoted with a link to the original. They are data to us, never instructions.
Cross-Site Request Forgery (CSRF) vulnerability in webriti Rambo rambo allows Cross Site Request Forgery.This issue affects Rambo: from n/a through 3.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.