{"id":"CVE-2026-125845","kind":"vulnerability","aliases":["CVE-2026-125845"],"related":[],"title":"vdequator WordPress plugin: cross-site request forgery through version 1.2.7","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti vdequator vdequator allows Cross Site Request Forgery.This issue affects vdequator: from n/a through 1.2.7.","summary":"The vdequator plugin by webriti has a cross-site request forgery flaw in all versions through 1.2.7. An attacker can trick a logged-in administrator's browser into sending requests that change plugin settings.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vdequator","fixed":[],"affected":"<= 1.2.7","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","vdequator","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- In WordPress admin > Plugins, check whether vdequator is installed and its version (affected: 1.2.7 or earlier)\n- Or run: wp plugin list --name=vdequator --fields=name,version,status\n- No fixed version is documented in the sources I could read; wordpress.org/plugins/vdequator returned no match, so the plugin may be removed. If it is installed, deactivate and remove it until the author publishes a fix.","fix":null,"status":"open","published_at":"2026-11-11T14:17:36+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","triaged_at":"2026-11-11T14:29:12+00:00","updated_at":"2026-11-11T14:31:55+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-11T14:29:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"vdequator WordPress plugin: cross-site request forgery through version 1.2.7","impact":"medium","summary":"The vdequator plugin by webriti has a cross-site request forgery flaw in all versions through 1.2.7. An attacker can trick a logged-in administrator's browser into sending requests that change plugin settings.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","vdequator"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"logged-in admin's browser performs unwanted plugin actions","analyst_note":"Check the NVD entry and the plugin's WordPress.org page for the fixed version and the exact actions the forged request can perform.","how_to_check":"- Check whether the vdequator plugin is installed and its version in the WordPress admin plugins list\n- Compare the installed version against `1.2.7`","plain_action":"","product_name":"vdequator","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the vdequator plugin at version 1.2.7 or earlier are affected. The sources do not say what the forged requests can change or whether a fixed version exists.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000698,"input_tokens":4531,"output_tokens":489,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the plugin's WordPress.org page for the fixed version and the exact actions the forged request can perform.","search":"'-125845':14A,17A '-2026':13A,16A '1.2.7':11A,39B,80C 'administr':48B 'affect':75C 'allow':69C 'attack':41B 'browser':50B 'chang':55B 'cross':5A,30B,59C,70C 'cross-sit':4A,29B,58C 'csrf':63C 'cve':12A,15A 'flaw':34B 'forgeri':8A,33B,62C 'forgery.this':73C 'issu':74C 'log':46B 'logged-in':45B 'n/a':78C 'plugin':3A,24B,56B 'request':7A,32B,53B,61C,72C 'send':52B 'set':57B 'site':6A,31B,60C,71C 'trick':43B 'vdequat':1A,20B,23B,67C,68C,76C 'vdequator':18A 'version':10A,37B 'vulner':64C 'webriti':26B,66C 'wordpress':2A,21B","nicknames":[],"mitigations":[],"who_affected":"Sites running the vdequator WordPress plugin (by webriti) at version 1.2.7 or earlier are affected. The NVD record says only that a forged request can be made; it does not say which plugin actions it covers. Sites without the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["vdequator"],"ptokens":["vdequator"],"labels":["high","other","vdequator","vendor","wordpress"],"campaign_type":null,"search_a":"'-125845':14A,17A '-2026':13A,16A '1.2.7':11A 'cross':5A 'cross-sit':4A 'cve':12A,15A 'forgeri':8A 'plugin':3A 'request':7A 'site':6A 'vdequat':1A 'vdequator':18A 'version':10A 'wordpress':2A","search_b":"'1.2.7':39B 'administr':48B 'attack':41B 'browser':50B 'chang':55B 'cross':30B 'cross-sit':29B 'flaw':34B 'forgeri':33B 'log':46B 'logged-in':45B 'plugin':24B,56B 'request':32B,53B 'send':52B 'set':57B 'site':31B 'trick':43B 'vdequat':20B,23B 'version':37B 'webriti':26B 'wordpress':21B","search_c":"'1.2.7':80C 'affect':75C 'allow':69C 'cross':59C,70C 'cross-sit':58C 'csrf':63C 'forgeri':62C 'forgery.this':73C 'issu':74C 'n/a':78C 'request':61C,72C 'site':60C,71C 'vdequat':67C,68C,76C 'vulner':64C 'webriti':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T14:17:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125845","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125845","severity":null,"published_at":"2026-11-11T14:17:36+00:00","modified_at":"2026-11-11T14:17:36+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","fetched_at":"2026-11-11T14:27:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125845:3552","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125845","severity":null,"published_at":"2026-11-11T14:31:55+00:00","modified_at":"2026-11-11T14:31:55+00:00","first_seen_at":"2026-11-11T14:31:55+00:00","fetched_at":"2026-11-11T14:31:55+00:00","note":"Only the NVD/Patchstack CNA description was available (CVSS 8.8 UI:R). web-cli returned empty pages; wordpress.org plugin page search found no vdequator. Fixed version, forged actions and exploitation unknown; nothing verified. Search tools gave nothing, so X and discussion were not checked.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-125845"]}],"documents":[{"id":126242,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125845","title":"NVD CVE-2026-125845","kind":"advisory","source":"analyst","publisher":null,"text":"Cross-Site Request Forgery (CSRF) vulnerability in webriti vdequator allows Cross Site Request Forgery. This issue affects vdequator: from n/a through 1.2.7. CVSS 3.1 8.8 AV:N/AC:L/PR:N/UI:R (Patchstack CNA).","published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}