---
id: "CVE-2026-125843"
page: "https://infrastack.ai/live/CVE-2026-125843"
kind: "vulnerability"
aliases: ["CVE-2026-125843"]
title: "Spasalon WordPress theme 3.0 and earlier: cross-site request forgery"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Spasalon", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Spasalon", "fixed": [], "affected": "<= 3.0", "ecosystem": "wordpress-theme"}]
ecosystems: ["vendor"]
tags: ["csrf", "other", "spasalon", "webriti", "wordpress", "wordpress-theme"]
not_affected_if: ["fixed-version", "not-spasalon"]
published_at: "2026-11-11T14:17:36+00:00"
first_seen_at: "2026-11-11T14:27:31+00:00"
updated_at: "2026-11-11T14:31:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125843", "first_seen_at": "2026-11-11T14:27:31+00:00"}, {"source": "analyst", "url": "https://wordpress.org/themes/spasalon/", "first_seen_at": "2026-11-11T14:31:43+00:00", "cites": ["https://wordpress.org/themes/spasalon/", "https://cvefeed.io/vuln/detail/CVE-2026-125843"]}]
exploit_sources: []
---

# Spasalon WordPress theme 3.0 and earlier: cross-site request forgery

Link for people: https://infrastack.ai/live/CVE-2026-125843 (this .md is for agents)

Spasalon is a WordPress theme by webriti. Versions up to 3.0, the latest on WordPress.org, are missing CSRF protection. A logged-in user who visits a malicious page can be made to perform actions. The sources do not say which actions.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Spasalon affected range not listed fixed no fixed version listed
- wordpress-theme:Spasalon affected <= 3.0 fixed no fixed version listed

## How to check

In WordPress admin go to Appearance > Themes and open Spasalon (active or installed); or read the Version line in wp-content/themes/spasalon/style.css. Version 3.0 or lower is affected. Remove inactive copies too.

## Fix

No fixed version known. WordPress.org lists 3.0 (updated 2026-08-31) as the latest release, and that version is affected. Switch to another theme or delete Spasalon until webriti releases a patch.

## Timeline

- 2026-11-11T14:27:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125843
- 2026-11-11T14:31:43+00:00 analyst https://wordpress.org/themes/spasalon/ — NVD/Patchstack record: CSRF in Spasalon theme <=3.0, CVSS 8.8, UI required. WordPress.org shows 3.0 as latest, so no fix. Exposed actions not stated in any source I could read; no Patchstack or vendor page fetched. Nothing verified.

## Documents

- [advisory] Spasalon theme, WordPress.org (latest 3.0) https://wordpress.org/themes/spasalon/
- [describes] CVE-2026-125843 WordPress Spasalon theme <= 3.0 CSRF (Patchstack record) https://cvefeed.io/vuln/detail/CVE-2026-125843

## From the sources

Cross-Site Request Forgery (CSRF) vulnerability in webriti Spasalon spasalon allows Cross Site Request Forgery.This issue affects Spasalon: from n/a through 3.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_