---
id: "CVE-2026-125844"
page: "https://infrastack.ai/live/CVE-2026-125844"
kind: "vulnerability"
aliases: ["CVE-2026-125844"]
title: "Vice WordPress theme (webriti) up to 1.4: cross-site request forgery"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "vice", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "vice", "fixed": [], "affected": "<= 1.4", "ecosystem": "wordpress-theme"}]
ecosystems: ["vendor"]
tags: ["csrf", "other", "vice", "webriti", "wordpress", "wordpress-theme"]
not_affected_if: ["vice-theme-not-installed"]
published_at: "2026-11-11T14:17:36+00:00"
first_seen_at: "2026-11-11T14:27:31+00:00"
updated_at: "2026-11-11T14:31:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125844", "first_seen_at": "2026-11-11T14:27:31+00:00"}, {"source": "analyst", "url": "https://patchstack.com/database/wordpress/theme/vice/vulnerabilities", "first_seen_at": "2026-11-11T14:31:40+00:00", "cites": ["https://patchstack.com/database/wordpress/theme/vice/vulnerabilities", "https://wordpress.org/themes/vice/"]}]
exploit_sources: []
---

# Vice WordPress theme (webriti) up to 1.4: cross-site request forgery

Link for people: https://infrastack.ai/live/CVE-2026-125844 (this .md is for agents)

Vice is a WordPress theme by webriti (child theme of Appointment, about 200 active installs). Versions up to and including 1.4 lack CSRF protection on some action, so an attacker can get a logged-in user, typically an admin, to send requests by visiting a crafted page. Patchstack rates it CVSS 8.8. The specific actions affected are not published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:vice affected range not listed fixed no fixed version listed
- wordpress-theme:vice affected <= 1.4 fixed no fixed version listed

## How to check

In WordPress admin go to Appearance > Themes, or check wp-content/themes/vice/style.css for 'Version:'. Exposed if the vice theme is installed (active or not) at 1.4 or earlier. Also check if you run the parent Appointment theme with Vice as the child theme.

## Fix

No fixed version found. WordPress.org lists 1.4 (updated June 7, 2026) as the current release, and Patchstack shows 0 patched. Until a fix ships, switch to another theme or delete the vice theme, and have admins log out before browsing other sites.

## Timeline

- 2026-11-11T14:27:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125844
- 2026-11-11T14:31:40+00:00 analyst https://patchstack.com/database/wordpress/theme/vice/vulnerabilities — Platform confirmed as WordPress theme via wordpress.org (latest 1.4) and Patchstack (<=1.4, 0 patched). No vendor advisory; affected actions unpublished; fix unknown, nothing verified.

## Documents

- [advisory] vice vulnerabilities - Patchstack https://patchstack.com/database/wordpress/theme/vice/vulnerabilities
- [describes] vice – WordPress theme (webriti) https://wordpress.org/themes/vice/

## From the sources

Cross-Site Request Forgery (CSRF) vulnerability in webriti vice vice allows Cross Site Request Forgery.This issue affects vice: from n/a through 1.4.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_