VDPERANTO · CVE-2026-125847 · Package
NO FIX YET · SEE WHAT TO DO
The vdperanto WordPress theme by Webriti, through version 2.2, lacks CSRF protection on at least one state-changing request. A logged-in privileged user who visits an attacker's page can be tricked into submitting it. Patchstack lists no patched version; the vulnerable endpoint is not described in the sources.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the vdperanto plugin at version 2.2 or earlier are in scope according to the NVD entry. The sources do not say which request paths are exposed or whether a fixed version exists. Sites without vdperanto installed can skip this.
Not affected if managed-hosting-with-theme-absent, plugin-not-installed, theme-not-installed
Who cares vdperanto, webriti, wordpress, wordpress-theme
Cross-Site Request Forgery (CSRF) vulnerability in webriti vdperanto vdperanto allows Cross Site Request Forgery.This issue affects vdperanto: from n/a through 2.2.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.