---
id: "CVE-2026-125842"
page: "https://infrastack.ai/live/CVE-2026-125842"
kind: "vulnerability"
aliases: ["CVE-2026-125842"]
title: "Wallstreet Agency WordPress theme: CSRF lets attackers trigger admin actions"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "wallstreet-agency", "fixed": [], "affected": "<= 1.3.4", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["csrf", "other", "wallstreet-agency", "webriti", "wordpress", "wordpress-theme"]
not_affected_if: ["theme-not-installed"]
published_at: "2026-11-11T14:17:36+00:00"
first_seen_at: "2026-11-11T14:27:31+00:00"
updated_at: "2026-11-11T14:31:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125842", "first_seen_at": "2026-11-11T14:27:31+00:00"}, {"source": "analyst", "url": "https://wordpress.org/themes/wallstreet-agency/", "first_seen_at": "2026-11-11T14:31:30+00:00", "cites": ["https://wordpress.org/themes/wallstreet-agency/", "https://app.opencve.io/cve/CVE-2026-125842"]}]
exploit_sources: []
---

# Wallstreet Agency WordPress theme: CSRF lets attackers trigger admin actions

Link for people: https://infrastack.ai/live/CVE-2026-125842 (this .md is for agents)

Wallstreet Agency by webriti has a cross-site request forgery flaw in versions through 1.3.4. A logged-in admin who visits a malicious page could be tricked into making changes on the site without knowing.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:wallstreet-agency affected <= 1.3.4 fixed no fixed version listed

## How to check

- WordPress admin > Appearance > Themes: open Wallstreet Agency and read its version, or read the Version line in wp-content/themes/wallstreet-agency/style.css
- Version 1.3.4 or earlier is affected; 1.3.4 is also the latest published release, so no fixed version exists yet
- Note the parent theme Wallstreet has its own CSRF CVE-2026-39718 (<= 2.8.6); check it too if you run this child theme

## Fix

No patched version known: the WordPress.org theme page still lists 1.3.4 (updated June 5, 2026) as current, which is the affected version. Remove or replace the theme, or switch to the parent Wallstreet theme's alternatives, until the vendor ships a fix.

## Timeline

- 2026-11-11T14:27:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125842
- 2026-11-11T14:31:30+00:00 analyst https://wordpress.org/themes/wallstreet-agency/ — NVD/Patchstack CSRF, CVSS 8.8, no vendor advisory found; WordPress.org shows 1.3.4 still current so no fix. Exact CSRF actions unknown. Not verified (no vendor advisory). Sibling webriti CSRF CVEs exist (e.g. CVE-2026-39718 parent theme).

## Documents

- [fix] Wallstreet Agency - WordPress.org theme directory (current version 1.3.4) https://wordpress.org/themes/wallstreet-agency/
- [mentions] OpenCVE: CVE-2026-125842 https://app.opencve.io/cve/CVE-2026-125842

## From the sources

Cross-Site Request Forgery (CSRF) vulnerability in webriti Wallstreet Agency wallstreet-agency allows Cross Site Request Forgery.This issue affects Wallstreet Agency: from n/a through 1.3.4.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_