{"id":"CVE-2026-125843","kind":"vulnerability","aliases":["CVE-2026-125843"],"related":[],"title":"Spasalon WordPress theme 3.0 and earlier: cross-site request forgery","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti Spasalon spasalon allows Cross Site Request Forgery.This issue affects Spasalon: from n/a through 3.0.","summary":"Spasalon is a WordPress theme by webriti. Versions up to 3.0, the latest on WordPress.org, are missing CSRF protection. A logged-in user who visits a malicious page can be made to perform actions. The sources do not say which actions.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Spasalon","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Spasalon","fixed":[],"affected":"<= 3.0","ecosystem":"wordpress-theme"}],"ecosystems":["vendor"],"tags":["csrf","other","spasalon","webriti","wordpress","wordpress-theme"],"not_affected_if":["fixed-version","not-spasalon"],"how_to_check":"In WordPress admin go to Appearance > Themes and open Spasalon (active or installed); or read the Version line in wp-content/themes/spasalon/style.css. Version 3.0 or lower is affected. Remove inactive copies too.","fix":"No fixed version known. WordPress.org lists 3.0 (updated 2026-08-31) as the latest release, and that version is affected. Switch to another theme or delete Spasalon until webriti releases a patch.","status":"open","published_at":"2026-11-11T14:17:36+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","triaged_at":"2026-11-11T14:29:13+00:00","updated_at":"2026-11-11T14:31:43+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T14:29:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Spasalon: cross-site request forgery lets attackers act as logged-in users","impact":"medium","summary":"Spasalon, a salon booking WordPress-style web product by webriti, has a cross-site request forgery flaw. A malicious web page can trigger actions on the site while a logged-in user visits it.","audience":"businesses","category":"other","nicknames":[],"who_cares":["spasalon","webriti","wordpress"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker performs administrative actions as a logged-in user","analyst_note":"Find the vendor advisory or fixed version for Spasalon 3.0 and confirm which actions the CSRF exposes at https://nvd.nist.gov/vuln/detail/CVE-2026-125843","how_to_check":"- Confirm whether the site runs Spasalon and which version is installed, affected through `3.0`\n- Check the theme or plugin version in the admin dashboard against the vendor's listing","plain_action":"","product_name":"Spasalon","needs_analyst":true,"not_affected_if":["not-spasalon","fixed-version"],"who_is_affected":"Sites running Spasalon version 3.0 or earlier, where administrators or staff are logged in while browsing other sites. The sources do not state which configuration or role is required beyond that.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":4538,"output_tokens":534,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory or fixed version for Spasalon 3.0 and confirm which actions the CSRF exposes at https://nvd.nist.gov/vuln/detail/CVE-2026-125843","search":"'-125843':14A,17A '-2026':13A,16A '3.0':4A,38B,92C 'action':62B,69B 'affect':87C 'allow':81C 'cross':8A,71C,82C 'cross-sit':7A,70C 'csrf':20B,45B,75C 'cve':12A,15A 'earlier':6A 'forgeri':11A,74C 'forgery.this':85C 'issu':86C 'latest':40B 'log':49B 'logged-in':48B 'made':59B 'malici':55B 'miss':44B 'n/a':90C 'page':56B 'perform':61B 'protect':46B 'request':10A,73C,84C 'say':67B 'site':9A,72C,83C 'sourc':64B 'spasalon':1A,18A,19A,22B,28B,79C,80C,88C 'theme':3A,27B,32B 'user':51B 'version':35B 'visit':53B 'vulner':76C 'webriti':23B,34B,78C 'wordpress':2A,24B,26B,31B 'wordpress-them':25B 'wordpress.org':42B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the Spasalon theme (webriti), version 3.0 or earlier, installed. An attacker needs a logged-in user, typically an admin, to visit a malicious page. The record does not say which actions are exposed. Sites that do not use Spasalon can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["spasalon"],"ptokens":["spasalon"],"labels":["csrf","high","other","spasalon","vendor","webriti","wordpress","wordpresstheme"],"campaign_type":null,"search_a":"'-125843':14A,17A '-2026':13A,16A '3.0':4A 'cross':8A 'cross-sit':7A 'cve':12A,15A 'earlier':6A 'forgeri':11A 'request':10A 'site':9A 'spasalon':1A,18A,19A 'theme':3A 'wordpress':2A","search_b":"'3.0':38B 'action':62B,69B 'csrf':20B,45B 'latest':40B 'log':49B 'logged-in':48B 'made':59B 'malici':55B 'miss':44B 'page':56B 'perform':61B 'protect':46B 'say':67B 'sourc':64B 'spasalon':22B,28B 'theme':27B,32B 'user':51B 'version':35B 'visit':53B 'webriti':23B,34B 'wordpress':24B,26B,31B 'wordpress-them':25B 'wordpress.org':42B","search_c":"'3.0':92C 'affect':87C 'allow':81C 'cross':71C,82C 'cross-sit':70C 'csrf':75C 'forgeri':74C 'forgery.this':85C 'issu':86C 'n/a':90C 'request':73C,84C 'site':72C,83C 'spasalon':79C,80C,88C 'vulner':76C 'webriti':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T14:17:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125843","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125843","severity":null,"published_at":"2026-11-11T14:17:36+00:00","modified_at":"2026-11-11T14:17:36+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","fetched_at":"2026-11-11T14:27:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125843:3554","url":"https://wordpress.org/themes/spasalon/","severity":null,"published_at":"2026-11-11T14:31:43+00:00","modified_at":"2026-11-11T14:31:43+00:00","first_seen_at":"2026-11-11T14:31:43+00:00","fetched_at":"2026-11-11T14:31:43+00:00","note":"NVD/Patchstack record: CSRF in Spasalon theme <=3.0, CVSS 8.8, UI required. WordPress.org shows 3.0 as latest, so no fix. Exposed actions not stated in any source I could read; no Patchstack or vendor page fetched. Nothing verified.","cites":["https://wordpress.org/themes/spasalon/","https://cvefeed.io/vuln/detail/CVE-2026-125843"]}],"documents":[{"id":126240,"url":"https://wordpress.org/themes/spasalon/","title":"Spasalon theme, WordPress.org (latest 3.0)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":126241,"url":"https://cvefeed.io/vuln/detail/CVE-2026-125843","title":"CVE-2026-125843 WordPress Spasalon theme <= 3.0 CSRF (Patchstack record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}