{"id":"CVE-2026-125840","kind":"vulnerability","aliases":["CVE-2026-125840"],"related":[],"title":"Rambo WordPress theme (webriti) up to 3.0: cross-site request forgery, no fixed version listed","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti Rambo rambo allows Cross Site Request Forgery.This issue affects Rambo: from n/a through 3.0.","summary":"Rambo is a WordPress theme by webriti. Versions up to and including 3.0 have a cross-site request forgery flaw (CVSS 8.8). An attacker who lures a logged-in user, such as an admin, to a malicious page can make their session perform actions without their knowledge. The affected actions are not named in the sources.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Rambo","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Rambo","fixed":[],"affected":"<= 3.0","ecosystem":"wordpress-theme"}],"ecosystems":["vendor"],"tags":["csrf","other","rambo","webriti","wordpress","wordpress-theme"],"not_affected_if":["not-wordpress","theme-not-installed","version-above-3.0"],"how_to_check":"In WordPress admin go to Appearance > Themes and see whether Rambo is installed, active or not, and which version. Or read the Version line in wp-content/themes/rambo/style.css, or run: wp theme list. Version 3.0 or earlier is affected. Installed but inactive themes should be deleted too.","fix":"No fixed version known. wordpress.org lists 3.0 as the latest release, and Patchstack shows 0 patched. If you do not need the theme, switch to another theme and delete Rambo.","status":"open","published_at":"2026-11-11T14:17:35+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","triaged_at":"2026-11-11T14:29:17+00:00","updated_at":"2026-11-11T14:32:50+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T14:29:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Rambo by webriti: cross-site request forgery lets attackers act as users","impact":"medium","summary":"Rambo, a product from webriti, has a cross-site request forgery flaw affecting versions up to and including 3.0. An attacker who lures a logged-in user to a malicious page can make the user's session perform actions without their knowledge.","audience":"businesses","category":"other","nicknames":[],"who_cares":["rambo","webriti"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Actions performed as a logged-in user without consent","analyst_note":"Check the NVD entry and the vendor's advisory for the fixed version and the affected actions; the sources give only the version range.","how_to_check":"- Look up the installed Rambo version and see whether it is 3.0 or earlier\n- Confirm the product is in use; the sources do not name the deployment method","plain_action":"","product_name":"Rambo","needs_analyst":true,"not_affected_if":["version-above-3.0"],"who_is_affected":"The NVD entry describes Rambo from n/a through 3.0 as affected; the sources do not say what Rambo is used for or which configurations are exposed. Teams running Rambo at or below 3.0 should review it. unknown whether a newer fixed version exists.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000713,"input_tokens":4535,"output_tokens":519,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the vendor's advisory for the fixed version and the affected actions; the sources give only the version range.","search":"'-125840':19A,22A '-2026':18A,21A '3.0':7A,45B,113C '8.8':55B 'action':78B,84B 'admin':68B 'affect':83B,108C 'allow':102C 'attack':57B 'cross':9A,49B,92C,103C 'cross-sit':8A,48B,91C 'csrf':25B,96C 'cve':17A,20A 'cvss':54B 'fix':14A 'flaw':53B 'forgeri':12A,52B,95C 'forgery.this':106C 'includ':44B 'issu':107C 'knowledg':81B 'list':16A 'log':62B 'logged-in':61B 'lure':59B 'make':74B 'malici':71B 'n/a':111C 'name':87B 'page':72B 'perform':77B 'rambo':1A,23A,24A,27B,33B,100C,101C,109C 'request':11A,51B,94C,105C 'session':76B 'site':10A,50B,93C,104C 'sourc':90B 'theme':3A,32B,37B 'user':64B 'version':15A,40B 'vulner':97C 'webriti':4A,28B,39B,99C 'without':79B 'wordpress':2A,29B,31B,36B 'wordpress-them':30B","nicknames":[],"mitigations":[],"who_affected":"The NVD entry describes Rambo from n/a through 3.0 as affected; the sources do not say what Rambo is used for or which configurations are exposed. Teams running Rambo at or below 3.0 should review it. unknown whether a newer fixed version exists.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["rambo"],"ptokens":["rambo"],"labels":["csrf","high","other","rambo","vendor","webriti","wordpress","wordpresstheme"],"campaign_type":null,"search_a":"'-125840':19A,22A '-2026':18A,21A '3.0':7A 'cross':9A 'cross-sit':8A 'cve':17A,20A 'fix':14A 'forgeri':12A 'list':16A 'rambo':1A,23A,24A 'request':11A 'site':10A 'theme':3A 'version':15A 'webriti':4A 'wordpress':2A","search_b":"'3.0':45B '8.8':55B 'action':78B,84B 'admin':68B 'affect':83B 'attack':57B 'cross':49B 'cross-sit':48B 'csrf':25B 'cvss':54B 'flaw':53B 'forgeri':52B 'includ':44B 'knowledg':81B 'log':62B 'logged-in':61B 'lure':59B 'make':74B 'malici':71B 'name':87B 'page':72B 'perform':77B 'rambo':27B,33B 'request':51B 'session':76B 'site':50B 'sourc':90B 'theme':32B,37B 'user':64B 'version':40B 'webriti':28B,39B 'without':79B 'wordpress':29B,31B,36B 'wordpress-them':30B","search_c":"'3.0':113C 'affect':108C 'allow':102C 'cross':92C,103C 'cross-sit':91C 'csrf':96C 'forgeri':95C 'forgery.this':106C 'issu':107C 'n/a':111C 'rambo':100C,101C,109C 'request':94C,105C 'site':93C,104C 'vulner':97C 'webriti':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T14:17:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125840","severity":null,"published_at":"2026-11-11T14:17:35+00:00","modified_at":"2026-11-11T14:17:36+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","fetched_at":"2026-11-11T14:27:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125840:3557","url":"https://patchstack.com/database/wordpress/theme/rambo/vulnerabilities","severity":null,"published_at":"2026-11-11T14:32:50+00:00","modified_at":"2026-11-11T14:32:50+00:00","first_seen_at":"2026-11-11T14:32:50+00:00","fetched_at":"2026-11-11T14:32:50+00:00","note":"Rambo is a WordPress theme by webriti (wordpress.org/themes/rambo, 500+ installs). Patchstack lists CSRF <= 3.0 with 0 patched; wordpress.org still lists 3.0 as latest, so no fixed version is visible. The vendor has published no advisory. Nothing verified: no vendor advisory was read. Exploitation and PoC unknown.","cites":["https://patchstack.com/database/wordpress/theme/rambo/vulnerabilities","https://wordpress.org/themes/rambo/"]}],"documents":[{"id":126248,"url":"https://patchstack.com/database/wordpress/theme/rambo/vulnerabilities","title":"Rambo Vulnerabilities - Patchstack","kind":"advisory","source":"analyst","publisher":null,"text":"Rambo (WordPress theme, Webriti): CSRF vulnerability <= 3.0; 1 present, 0 patched.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":126249,"url":"https://wordpress.org/themes/rambo/","title":"Rambo - WordPress.org theme directory","kind":"vendor","source":"analyst","publisher":null,"text":"Rambo by webriti. Version 3.0, last updated June 18, 2026. 500+ active installations. Latest listed version is 3.0, the last affected version.","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}