{"id":"CVE-2026-125842","kind":"vulnerability","aliases":["CVE-2026-125842"],"related":[],"title":"Wallstreet Agency WordPress theme: CSRF lets attackers trigger admin actions","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti Wallstreet Agency wallstreet-agency allows Cross Site Request Forgery.This issue affects Wallstreet Agency: from n/a through 1.3.4.","summary":"Wallstreet Agency by webriti has a cross-site request forgery flaw in versions through 1.3.4. A logged-in admin who visits a malicious page could be tricked into making changes on the site without knowing.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wallstreet-agency","fixed":[],"affected":"<= 1.3.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["csrf","other","wallstreet-agency","webriti","wordpress","wordpress-theme"],"not_affected_if":["theme-not-installed"],"how_to_check":"- WordPress admin > Appearance > Themes: open Wallstreet Agency and read its version, or read the Version line in wp-content/themes/wallstreet-agency/style.css\n- Version 1.3.4 or earlier is affected; 1.3.4 is also the latest published release, so no fixed version exists yet\n- Note the parent theme Wallstreet has its own CSRF CVE-2026-39718 (<= 2.8.6); check it too if you run this child theme","fix":"No patched version known: the WordPress.org theme page still lists 1.3.4 (updated June 5, 2026) as current, which is the affected version. Remove or replace the theme, or switch to the parent Wallstreet theme's alternatives, until the vendor ships a fix.","status":"open","published_at":"2026-11-11T14:17:36+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","triaged_at":"2026-11-11T14:29:15+00:00","updated_at":"2026-11-11T14:31:30+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-11T14:29:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Wallstreet Agency WordPress theme: CSRF lets attackers trigger admin actions","impact":"medium","summary":"Wallstreet Agency by webriti has a cross-site request forgery flaw in versions through 1.3.4. A logged-in admin who visits a malicious page could be tricked into making changes on the site without knowing.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","wallstreet-agency","webriti"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Unauthorized site changes made through a victim's logged-in session","analyst_note":"Confirm the fixed version and the exact actions reachable via CSRF from the NVD entry or the vendor advisory.","how_to_check":"- Check the installed version of Wallstreet Agency (wallstreet-agency) in the WordPress admin under Appearance or the theme's style.css header\n- Compare the version against `1.3.4`; unknown whether a newer version is fixed","plain_action":"","product_name":"wallstreet-agency","needs_analyst":true,"not_affected_if":["theme-not-installed"],"who_is_affected":"Sites running the Wallstreet Agency theme at version 1.3.4 or earlier. The sources do not say which features are exposed, so any site on this theme should be treated as potentially affected until checked. Sites that do not use this theme can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000735,"input_tokens":4552,"output_tokens":559,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the exact actions reachable via CSRF from the NVD entry or the vendor advisory.","search":"'-125842':13A,16A '-2026':12A,15A '1.3.4':45B,93C 'action':10A 'admin':9A,50B 'affect':87C 'agenc':2A,24B,31B,77C,80C,89C 'agency':19A 'allow':81C 'attack':7A 'chang':61B 'could':56B 'cross':37B,68C,82C 'cross-sit':36B,67C 'csrf':5A,20B,72C 'cve':11A,14A 'flaw':41B 'forgeri':40B,71C 'forgery.this':85C 'issu':86C 'know':66B 'let':6A 'log':48B 'logged-in':47B 'make':60B 'malici':54B 'n/a':91C 'page':55B 'request':39B,70C,84C 'site':38B,64B,69C,83C 'theme':4A,29B 'trick':58B 'trigger':8A 'version':43B 'visit':52B 'vulner':73C 'wallstreet':1A,18A,23B,30B,76C,79C,88C 'wallstreet-ag':22B,78C 'wallstreet-agency':17A 'webriti':25B,33B,75C 'without':65B 'wordpress':3A,26B,28B 'wordpress-them':27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Wallstreet Agency child theme (webriti) at 1.3.4 or earlier, which is the current release; about 100+ active installs. Exploitation needs a logged-in privileged user to be lured to a malicious page. The exact actions and endpoints are not stated in the NVD or Patchstack data. Sites that do not have this theme installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["wallstreetagency"],"ptokens":["agency","wallstreet"],"labels":["csrf","high","other","vendor","wallstreetagency","webriti","wordpress","wordpresstheme"],"campaign_type":null,"search_a":"'-125842':13A,16A '-2026':12A,15A 'action':10A 'admin':9A 'agenc':2A 'agency':19A 'attack':7A 'csrf':5A 'cve':11A,14A 'let':6A 'theme':4A 'trigger':8A 'wallstreet':1A,18A 'wallstreet-agency':17A 'wordpress':3A","search_b":"'1.3.4':45B 'admin':50B 'agenc':24B,31B 'chang':61B 'could':56B 'cross':37B 'cross-sit':36B 'csrf':20B 'flaw':41B 'forgeri':40B 'know':66B 'log':48B 'logged-in':47B 'make':60B 'malici':54B 'page':55B 'request':39B 'site':38B,64B 'theme':29B 'trick':58B 'version':43B 'visit':52B 'wallstreet':23B,30B 'wallstreet-ag':22B 'webriti':25B,33B 'without':65B 'wordpress':26B,28B 'wordpress-them':27B","search_c":"'1.3.4':93C 'affect':87C 'agenc':77C,80C,89C 'allow':81C 'cross':68C,82C 'cross-sit':67C 'csrf':72C 'forgeri':71C 'forgery.this':85C 'issu':86C 'n/a':91C 'request':70C,84C 'site':69C,83C 'vulner':73C 'wallstreet':76C,79C,88C 'wallstreet-ag':78C 'webriti':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T14:17:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125842","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125842","severity":null,"published_at":"2026-11-11T14:17:36+00:00","modified_at":"2026-11-11T14:17:36+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","fetched_at":"2026-11-11T14:27:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125842:3555","url":"https://wordpress.org/themes/wallstreet-agency/","severity":null,"published_at":"2026-11-11T14:31:30+00:00","modified_at":"2026-11-11T14:31:30+00:00","first_seen_at":"2026-11-11T14:31:30+00:00","fetched_at":"2026-11-11T14:31:30+00:00","note":"NVD/Patchstack CSRF, CVSS 8.8, no vendor advisory found; WordPress.org shows 1.3.4 still current so no fix. Exact CSRF actions unknown. Not verified (no vendor advisory). Sibling webriti CSRF CVEs exist (e.g. CVE-2026-39718 parent theme).","cites":["https://wordpress.org/themes/wallstreet-agency/","https://app.opencve.io/cve/CVE-2026-125842"]}],"documents":[{"id":126236,"url":"https://wordpress.org/themes/wallstreet-agency/","title":"Wallstreet Agency - WordPress.org theme directory (current version 1.3.4)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":126237,"url":"https://app.opencve.io/cve/CVE-2026-125842","title":"OpenCVE: CVE-2026-125842","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}