---
id: "CVE-2026-125846"
page: "https://infrastack.ai/live/CVE-2026-125846"
kind: "vulnerability"
aliases: ["CVE-2026-125846"]
title: "Mazino WordPress theme 1.1 and earlier: CSRF lets attackers act as a logged-in user, no patch"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "mazino", "fixed": [], "affected": "<= 1.1", "ecosystem": "wordpress-theme"}]
ecosystems: []
tags: ["csrf", "mazino", "other", "webriti", "wordpress", "wordpress-theme"]
not_affected_if: ["not-installed"]
published_at: "2026-11-11T14:17:36+00:00"
first_seen_at: "2026-11-11T14:27:31+00:00"
updated_at: "2026-11-11T14:30:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125846", "first_seen_at": "2026-11-11T14:27:31+00:00"}, {"source": "analyst", "url": "https://patchstack.com/database/wordpress/theme/mazino/vulnerability/wordpress-mazino-theme-1-1-cross-site-request-forgery-csrf-vulnerability", "first_seen_at": "2026-11-11T14:30:30+00:00", "cites": ["https://patchstack.com/database/wordpress/theme/mazino/vulnerability/wordpress-mazino-theme-1-1-cross-site-request-forgery-csrf-vulnerability", "https://wordpress.org/themes/mazino/"]}]
exploit_sources: []
---

# Mazino WordPress theme 1.1 and earlier: CSRF lets attackers act as a logged-in user, no patch

Link for people: https://infrastack.ai/live/CVE-2026-125846 (this .md is for agents)

Mazino is a WordPress theme by webriti (a child theme of Quality, 200+ active installs). Versions up to and including 1.1 are open to cross-site request forgery. Patchstack rates it CVSS 8.8, needs no privileges from the attacker, and needs a logged-in user (typically an admin) to open a crafted page or link. Patchstack lists no patched version, and WordPress.org still shows 1.1 as the current release, last updated January 2026. No exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-theme:mazino affected <= 1.1 fixed no fixed version listed

## How to check

In WordPress admin go to Appearance > Themes and look for Mazino, or run 'wp theme list' and look for mazino at version 1.1 or lower. Also check whether a child theme of Quality or a Mazino copy is active on staging sites.

## Fix

No patched version is listed by Patchstack, and WordPress.org shows 1.1 as the latest. Switch to a maintained theme and delete Mazino; Patchstack notes that deactivating alone does not remove the risk.

## Timeline

- 2026-11-11T14:27:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125846
- 2026-11-11T14:30:30+00:00 analyst https://patchstack.com/database/wordpress/theme/mazino/vulnerability/wordpress-mazino-theme-1-1-cross-site-request-forgery-csrf-vulnerability — Mazino is a WordPress theme; Patchstack (CNA) says all versions <=1.1 are affected, with no patch, and WordPress.org still shows 1.1. Nothing verified: Patchstack is not the maintainer. Exploitation and PoC not seen. Fix-status none comes from Patchstack plus the WordPress.org listing.

## Documents

- [advisory] Patchstack: WordPress Mazino Theme <= 1.1 CSRF https://patchstack.com/database/wordpress/theme/mazino/vulnerability/wordpress-mazino-theme-1-1-cross-site-request-forgery-csrf-vulnerability
- [describes] Mazino theme on WordPress.org (v1.1, 200+ installs) https://wordpress.org/themes/mazino/

## From the sources

Cross-Site Request Forgery (CSRF) vulnerability in webriti Mazino mazino allows Cross Site Request Forgery.This issue affects Mazino: from n/a through 1.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_