{"id":"CVE-2026-125846","kind":"vulnerability","aliases":["CVE-2026-125846"],"related":[],"title":"Mazino WordPress theme 1.1 and earlier: CSRF lets attackers act as a logged-in user, no patch","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti Mazino mazino allows Cross Site Request Forgery.This issue affects Mazino: from n/a through 1.1.","summary":"Mazino is a WordPress theme by webriti (a child theme of Quality, 200+ active installs). Versions up to and including 1.1 are open to cross-site request forgery. Patchstack rates it CVSS 8.8, needs no privileges from the attacker, and needs a logged-in user (typically an admin) to open a crafted page or link. Patchstack lists no patched version, and WordPress.org still shows 1.1 as the current release, last updated January 2026. No exploitation or public PoC found.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mazino","fixed":[],"affected":"<= 1.1","ecosystem":"wordpress-theme"}],"ecosystems":[],"tags":["csrf","mazino","other","webriti","wordpress","wordpress-theme"],"not_affected_if":["not-installed"],"how_to_check":"In WordPress admin go to Appearance > Themes and look for Mazino, or run 'wp theme list' and look for mazino at version 1.1 or lower. Also check whether a child theme of Quality or a Mazino copy is active on staging sites.","fix":"No patched version is listed by Patchstack, and WordPress.org shows 1.1 as the latest. Switch to a maintained theme and delete Mazino; Patchstack notes that deactivating alone does not remove the risk.","status":"open","published_at":"2026-11-11T14:17:36+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","triaged_at":"2026-11-11T14:29:11+00:00","updated_at":"2026-11-11T14:30:30+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-11T14:29:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Mazino (webriti): cross-site request forgery lets attackers act as users","impact":"medium","summary":"Mazino by webriti has a cross-site request forgery flaw affecting versions up to and including 1.1. A malicious web page can trick a logged-in user's browser into sending unwanted requests to the site, performing actions as that user.","audience":"businesses","category":"other","nicknames":[],"who_cares":["mazino","webriti","wordpress"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker performs state-changing actions as a logged-in user","analyst_note":"Confirm the product type (WordPress theme or plugin?), the fixed version after 1.1, and the affected actions from the vendor page or NVD.","how_to_check":"- Confirm whether the Mazino product is installed and which version is running, against the affected range through 1.1.\n- unknown for further specifics; the sources do not describe the exact endpoint or setting.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites or products running Mazino 1.1 or earlier are affected according to the NVD description. The sources do not say which configuration or role is required, so unknown.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":4533,"output_tokens":496,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the product type (WordPress theme or plugin?), the fixed version after 1.1, and the affected actions from the vendor page or NVD.","search":"'-125846':21A,24A '-2026':20A,23A '1.1':4A,54B,100B,137C '200':46B '2026':108B '8.8':67B 'act':10A 'activ':47B 'admin':83B 'affect':132C 'allow':126C 'attack':9A,73B 'child':42B 'craft':87B 'cross':59B,116C,127C 'cross-sit':58B,115C 'csrf':7A,26B,120C 'current':103B 'cve':19A,22A 'cvss':66B 'earlier':6A 'exploit':110B 'forgeri':62B,119C 'forgery.this':130C 'found':114B 'includ':53B 'instal':48B 'issu':131C 'januari':107B 'last':105B 'let':8A 'link':90B 'list':92B 'log':14A,78B 'logged-in':13A,77B 'mazino':1A,25A,27B,34B,124C,125C,133C 'n/a':135C 'need':68B,75B 'open':56B,85B 'page':88B 'patch':18A,94B 'patchstack':63B,91B 'poc':113B 'privileg':70B 'public':112B 'qualiti':45B 'rate':64B 'releas':104B 'request':61B,118C,129C 'show':99B 'site':60B,117C,128C 'still':98B 'theme':3A,33B,38B,43B 'typic':81B 'updat':106B 'user':16A,80B 'version':49B,95B 'vulner':121C 'webriti':29B,40B,123C 'wordpress':2A,30B,32B,37B 'wordpress-them':31B 'wordpress.org':97B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the Mazino theme (version 1.1 or earlier) installed. The risk is highest if an admin is logged in while browsing other sites. Sites that do not have Mazino installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["mazino"],"ptokens":["mazino"],"labels":["csrf","high","mazino","other","webriti","wordpress","wordpresstheme"],"campaign_type":null,"search_a":"'-125846':21A,24A '-2026':20A,23A '1.1':4A 'act':10A 'attack':9A 'csrf':7A 'cve':19A,22A 'earlier':6A 'let':8A 'log':14A 'logged-in':13A 'mazino':1A,25A 'patch':18A 'theme':3A 'user':16A 'wordpress':2A","search_b":"'1.1':54B,100B '200':46B '2026':108B '8.8':67B 'activ':47B 'admin':83B 'attack':73B 'child':42B 'craft':87B 'cross':59B 'cross-sit':58B 'csrf':26B 'current':103B 'cvss':66B 'exploit':110B 'forgeri':62B 'found':114B 'includ':53B 'instal':48B 'januari':107B 'last':105B 'link':90B 'list':92B 'log':78B 'logged-in':77B 'mazino':27B,34B 'need':68B,75B 'open':56B,85B 'page':88B 'patch':94B 'patchstack':63B,91B 'poc':113B 'privileg':70B 'public':112B 'qualiti':45B 'rate':64B 'releas':104B 'request':61B 'show':99B 'site':60B 'still':98B 'theme':33B,38B,43B 'typic':81B 'updat':106B 'user':80B 'version':49B,95B 'webriti':29B,40B 'wordpress':30B,32B,37B 'wordpress-them':31B 'wordpress.org':97B","search_c":"'1.1':137C 'affect':132C 'allow':126C 'cross':116C,127C 'cross-sit':115C 'csrf':120C 'forgeri':119C 'forgery.this':130C 'issu':131C 'mazino':124C,125C,133C 'n/a':135C 'request':118C,129C 'site':117C,128C 'vulner':121C 'webriti':123C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T14:17:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125846","severity":null,"published_at":"2026-11-11T14:17:36+00:00","modified_at":"2026-11-11T14:17:37+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","fetched_at":"2026-11-11T14:27:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125846:3551","url":"https://patchstack.com/database/wordpress/theme/mazino/vulnerability/wordpress-mazino-theme-1-1-cross-site-request-forgery-csrf-vulnerability","severity":null,"published_at":"2026-11-11T14:30:30+00:00","modified_at":"2026-11-11T14:30:30+00:00","first_seen_at":"2026-11-11T14:30:30+00:00","fetched_at":"2026-11-11T14:30:30+00:00","note":"Mazino is a WordPress theme; Patchstack (CNA) says all versions <=1.1 are affected, with no patch, and WordPress.org still shows 1.1. Nothing verified: Patchstack is not the maintainer. Exploitation and PoC not seen. Fix-status none comes from Patchstack plus the WordPress.org listing.","cites":["https://patchstack.com/database/wordpress/theme/mazino/vulnerability/wordpress-mazino-theme-1-1-cross-site-request-forgery-csrf-vulnerability","https://wordpress.org/themes/mazino/"]}],"documents":[{"id":126223,"url":"https://patchstack.com/database/wordpress/theme/mazino/vulnerability/wordpress-mazino-theme-1-1-cross-site-request-forgery-csrf-vulnerability","title":"Patchstack: WordPress Mazino Theme <= 1.1 CSRF","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":126224,"url":"https://wordpress.org/themes/mazino/","title":"Mazino theme on WordPress.org (v1.1, 200+ installs)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}