{"id":"CVE-2026-125844","kind":"vulnerability","aliases":["CVE-2026-125844"],"related":[],"title":"Vice WordPress theme (webriti) up to 1.4: cross-site request forgery","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti vice vice allows Cross Site Request Forgery.This issue affects vice: from n/a through 1.4.","summary":"Vice is a WordPress theme by webriti (child theme of Appointment, about 200 active installs). Versions up to and including 1.4 lack CSRF protection on some action, so an attacker can get a logged-in user, typically an admin, to send requests by visiting a crafted page. Patchstack rates it CVSS 8.8. The specific actions affected are not published.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vice","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"vice","fixed":[],"affected":"<= 1.4","ecosystem":"wordpress-theme"}],"ecosystems":["vendor"],"tags":["csrf","other","vice","webriti","wordpress","wordpress-theme"],"not_affected_if":["vice-theme-not-installed"],"how_to_check":"In WordPress admin go to Appearance > Themes, or check wp-content/themes/vice/style.css for 'Version:'. Exposed if the vice theme is installed (active or not) at 1.4 or earlier. Also check if you run the parent Appointment theme with Vice as the child theme.","fix":"No fixed version found. WordPress.org lists 1.4 (updated June 7, 2026) as the current release, and Patchstack shows 0 patched. Until a fix ships, switch to another theme or delete the vice theme, and have admins log out before browsing other sites.","status":"open","published_at":"2026-11-11T14:17:36+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","triaged_at":"2026-11-11T14:29:12+00:00","updated_at":"2026-11-11T14:31:40+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T14:29:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Vice (webriti): cross-site request forgery lets attackers act as users","impact":"medium","summary":"The vice product by webriti has a cross-site request forgery flaw affecting versions through 1.4. An attacker can trick a logged-in user's browser into sending requests that the application accepts as the user's own.","audience":"businesses","category":"other","nicknames":[],"who_cares":["vice","webriti"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Authenticated users unknowingly perform state-changing actions in the application","analyst_note":"Find the vice product page and advisory from webriti to confirm its platform, the fixed version and the affected actions; the NVD entry gives only the affected range.","how_to_check":"unknown","plain_action":"","product_name":"vice","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources do not name the platform the vice product runs on, so exposure depends on whether the team runs webriti's vice at version 1.4 or earlier. unknown beyond that.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000671,"input_tokens":4527,"output_tokens":437,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vice product page and advisory from webriti to confirm its platform, the fixed version and the affected actions; the NVD entry gives only the affected range.","search":"'-125844':15A,18A '-2026':14A,17A '1.4':7A,49B,111C '200':41B '8.8':81B 'action':55B,84B 'activ':42B 'admin':68B 'affect':85B,106C 'allow':100C 'appoint':39B 'attack':58B 'child':36B 'craft':75B 'cross':9A,90C,101C 'cross-sit':8A,89C 'csrf':21B,51B,94C 'cve':13A,16A 'cvss':80B 'forgeri':12A,93C 'forgery.this':104C 'get':60B 'includ':48B 'instal':43B 'issu':105C 'lack':50B 'log':63B 'logged-in':62B 'n/a':109C 'page':76B 'patchstack':77B 'protect':52B 'publish':88B 'rate':78B 'request':11A,71B,92C,103C 'send':70B 'site':10A,91C,102C 'specif':83B 'theme':3A,28B,33B,37B 'typic':66B 'user':65B 'version':44B 'vice':1A,19A,20A,23B,29B,98C,99C,107C 'visit':73B 'vulner':95C 'webriti':4A,24B,35B,97C 'wordpress':2A,25B,27B,32B 'wordpress-them':26B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the webriti Vice theme at version 1.4 or earlier. An attacker needs a logged-in user, usually an administrator, to open a malicious page or link. Sites that do not have the Vice theme installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["vice"],"ptokens":["vice"],"labels":["csrf","high","other","vendor","vice","webriti","wordpress","wordpresstheme"],"campaign_type":null,"search_a":"'-125844':15A,18A '-2026':14A,17A '1.4':7A 'cross':9A 'cross-sit':8A 'cve':13A,16A 'forgeri':12A 'request':11A 'site':10A 'theme':3A 'vice':1A,19A,20A 'webriti':4A 'wordpress':2A","search_b":"'1.4':49B '200':41B '8.8':81B 'action':55B,84B 'activ':42B 'admin':68B 'affect':85B 'appoint':39B 'attack':58B 'child':36B 'craft':75B 'csrf':21B,51B 'cvss':80B 'get':60B 'includ':48B 'instal':43B 'lack':50B 'log':63B 'logged-in':62B 'page':76B 'patchstack':77B 'protect':52B 'publish':88B 'rate':78B 'request':71B 'send':70B 'specif':83B 'theme':28B,33B,37B 'typic':66B 'user':65B 'version':44B 'vice':23B,29B 'visit':73B 'webriti':24B,35B 'wordpress':25B,27B,32B 'wordpress-them':26B","search_c":"'1.4':111C 'affect':106C 'allow':100C 'cross':90C,101C 'cross-sit':89C 'csrf':94C 'forgeri':93C 'forgery.this':104C 'issu':105C 'n/a':109C 'request':92C,103C 'site':91C,102C 'vice':98C,99C,107C 'vulner':95C 'webriti':97C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T14:17:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125844","severity":null,"published_at":"2026-11-11T14:17:36+00:00","modified_at":"2026-11-11T14:17:36+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","fetched_at":"2026-11-11T14:27:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125844:3553","url":"https://wordpress.org/themes/vice/","severity":null,"published_at":"2026-11-11T14:31:40+00:00","modified_at":"2026-11-11T14:31:40+00:00","first_seen_at":"2026-11-11T14:31:40+00:00","fetched_at":"2026-11-11T14:31:40+00:00","note":"Platform confirmed as WordPress theme via wordpress.org (latest 1.4) and Patchstack (<=1.4, 0 patched). No vendor advisory; affected actions unpublished; fix unknown, nothing verified.","cites":["https://wordpress.org/themes/vice/","https://patchstack.com/database/wordpress/theme/vice/vulnerabilities"]}],"documents":[{"id":126238,"url":"https://wordpress.org/themes/vice/","title":"vice – WordPress theme (webriti)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":126239,"url":"https://patchstack.com/database/wordpress/theme/vice/vulnerabilities","title":"vice vulnerabilities - Patchstack","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}