{"id":"CVE-2026-125841","kind":"vulnerability","aliases":["CVE-2026-125841"],"related":[],"title":"Heroic WordPress theme through 1.4.2: cross-site request forgery, no fixed version listed","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti Heroic heroic allows Cross Site Request Forgery.This issue affects Heroic: from n/a through 1.4.2.","summary":"Heroic by webriti has a cross-site request forgery flaw affecting versions through 1.4.2. A logged-in user who visits a malicious page could have unwanted actions performed on the site without their knowledge.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Heroic","fixed":[],"affected":"<= 1.4.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["csrf","heroic-theme","other","webriti","wordpress","wordpress-theme"],"not_affected_if":["theme-not-active","theme-not-installed"],"how_to_check":"- In WordPress admin go to Appearance > Themes, or open wp-content/themes/heroic/style.css and read the Version header.\n- Version 1.4.2 or earlier is in the reported range. 1.4.2 is also the latest release on wordpress.org, so no newer version exists to move to.\n- Also check for Heroic installed but inactive; remove it if unused.","fix":"No fixed version known. The wordpress.org theme page still lists 1.4.2 (updated 2026-01-01) as the latest release, and Patchstack shows 0 patched. Until a newer version appears, switch to another theme or remove Heroic if you do not use it.","status":"open","published_at":"2026-11-11T14:17:36+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","triaged_at":"2026-11-11T14:29:16+00:00","updated_at":"2026-11-11T14:32:39+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T14:29:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Heroic WordPress theme: cross-site request forgery lets attackers act as admins","impact":"medium","summary":"Heroic by webriti has a cross-site request forgery flaw affecting versions through 1.4.2. A logged-in user who visits a malicious page could have unwanted actions performed on the site without their knowledge.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","heroic-theme"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Logged-in admin actions are performed by an attacker via a forged request.","analyst_note":"Confirm the product (WordPress theme by webriti) and the fixed version from the NVD entry or vendor page; the sources give only 'through 1.4.2'.","how_to_check":"- Check the installed Heroic theme version in the WordPress admin under Appearance > Themes, or in the theme's style.css header.\n- Compare the version against `1.4.2`; anything at or below it is in the reported range.","plain_action":"","product_name":"Heroic","needs_analyst":true,"not_affected_if":["theme-not-installed"],"who_is_affected":"Sites running the Heroic theme version 1.4.2 or earlier are in the reported range. The sources do not say which actions are exposed or what configuration matters beyond the theme itself, so unknown. Sites without the theme can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":4535,"output_tokens":550,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the product (WordPress theme by webriti) and the fixed version from the NVD entry or vendor page; the sources give only 'through 1.4.2'.","search":"'-125841':17A,20A '-2026':16A,19A '1.4.2':5A,46B,90C 'action':60B 'affect':43B,85C 'allow':79C 'could':57B 'cross':7A,38B,69C,80C 'cross-sit':6A,37B,68C 'csrf':22B,73C 'cve':15A,18A 'fix':12A 'flaw':42B 'forgeri':10A,41B,72C 'forgery.this':83C 'heroic':1A,21A,24B,32B,77C,78C,86C 'heroic-them':23B 'issu':84C 'knowledg':67B 'list':14A 'log':49B 'logged-in':48B 'malici':55B 'n/a':88C 'page':56B 'perform':61B 'request':9A,40B,71C,82C 'site':8A,39B,64B,70C,81C 'theme':3A,25B,31B 'unwant':59B 'user':51B 'version':13A,44B 'visit':53B 'vulner':74C 'webriti':27B,34B,76C 'without':65B 'wordpress':2A,28B,30B 'wordpress-them':29B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the Heroic theme (by webriti, a child theme of Quality, about 500+ installs) at version 1.4.2 or earlier. Patchstack, the CVE assigner, reports a CSRF flaw (CVSS 8.8): a logged-in user, likely an admin, who visits a malicious page can have actions performed on the site. The affected actions are not stated in the sources I read. Sites without the theme can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["heroic"],"ptokens":["heroic"],"labels":["csrf","heroictheme","high","other","vendor","webriti","wordpress","wordpresstheme"],"campaign_type":null,"search_a":"'-125841':17A,20A '-2026':16A,19A '1.4.2':5A 'cross':7A 'cross-sit':6A 'cve':15A,18A 'fix':12A 'forgeri':10A 'heroic':1A,21A 'list':14A 'request':9A 'site':8A 'theme':3A 'version':13A 'wordpress':2A","search_b":"'1.4.2':46B 'action':60B 'affect':43B 'could':57B 'cross':38B 'cross-sit':37B 'csrf':22B 'flaw':42B 'forgeri':41B 'heroic':24B,32B 'heroic-them':23B 'knowledg':67B 'log':49B 'logged-in':48B 'malici':55B 'page':56B 'perform':61B 'request':40B 'site':39B,64B 'theme':25B,31B 'unwant':59B 'user':51B 'version':44B 'visit':53B 'webriti':27B,34B 'without':65B 'wordpress':28B,30B 'wordpress-them':29B","search_c":"'1.4.2':90C 'affect':85C 'allow':79C 'cross':69C,80C 'cross-sit':68C 'csrf':73C 'forgeri':72C 'forgery.this':83C 'heroic':77C,78C,86C 'issu':84C 'n/a':88C 'request':71C,82C 'site':70C,81C 'vulner':74C 'webriti':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T14:17:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125841","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125841","severity":null,"published_at":"2026-11-11T14:17:36+00:00","modified_at":"2026-11-11T14:17:36+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","fetched_at":"2026-11-11T14:27:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125841:3556","url":"https://wordpress.org/themes/heroic/","severity":null,"published_at":"2026-11-11T14:32:39+00:00","modified_at":"2026-11-11T14:32:39+00:00","first_seen_at":"2026-11-11T14:32:39+00:00","fetched_at":"2026-11-11T14:32:39+00:00","note":"NVD page returns 'not found' yet; Patchstack (CNA) lists CSRF <= 1.4.2, wordpress.org shows 1.4.2 as latest so no fix; no vendor advisory found. Nothing verified (no vendor statement). X skipped; low-profile theme.","cites":["https://wordpress.org/themes/heroic/","https://patchstack.com/database/wordpress/theme/heroic/vulnerabilities"]}],"documents":[{"id":126244,"url":"https://wordpress.org/themes/heroic/","title":"Heroic – WordPress theme (wordpress.org)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":126245,"url":"https://patchstack.com/database/wordpress/theme/heroic/vulnerabilities","title":"Heroic Vulnerabilities - Patchstack","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}