{"id":"CVE-2026-125847","kind":"vulnerability","aliases":["CVE-2026-125847"],"related":[],"title":"vdperanto WordPress theme through 2.2: cross-site request forgery, no fix listed","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti vdperanto vdperanto allows Cross Site Request Forgery.This issue affects vdperanto: from n/a through 2.2.","summary":"The vdperanto WordPress theme by Webriti, through version 2.2, lacks CSRF protection on at least one state-changing request. A logged-in privileged user who visits an attacker's page can be tricked into submitting it. Patchstack lists no patched version; the vulnerable endpoint is not described in the sources.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vdperanto","fixed":[],"affected":"<= 2.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","vdperanto","webriti","wordpress","wordpress-theme"],"not_affected_if":["managed-hosting-with-theme-absent","plugin-not-installed","theme-not-installed"],"how_to_check":"- In WordPress admin go to Appearance > Themes and read the vdperanto version, or check wp-content/themes/vdperanto/style.css (Version header).\n- Version 2.2 or lower is in the affected range.","fix":"No fixed version published as of 2026-11-11 per Patchstack (0 patched). Until then, switch to another theme or remove vdperanto if unused; admins should log out of wp-admin before browsing elsewhere.","status":"open","published_at":"2026-11-11T14:17:37+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","triaged_at":"2026-11-11T14:29:09+00:00","updated_at":"2026-11-11T14:30:34+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T14:29:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"vdperanto WordPress theme: cross-site request forgery lets attackers act as admins","impact":"medium","summary":"The vdperanto plugin from webriti has a cross-site request forgery flaw affecting versions through 2.2. A logged-in user who opens a malicious page can be tricked into making requests the plugin accepts, which can change settings on the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","vdperanto","webriti"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Logged-in admin unknowingly changes site settings via forged requests","analyst_note":"Confirm the fixed version and the affected endpoints from the vendor or Wordfence/WPScan pages for CVE-2026-125847.","how_to_check":"- Check the installed vdperanto version in the WordPress admin plugin list or the plugin's readme.\n- Look for `vdperanto` under wp-content/plugins/ and read its version header.","plain_action":"","product_name":"vdperanto","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the vdperanto plugin at version 2.2 or earlier are in scope according to the NVD entry. The sources do not say which request paths are exposed or whether a fixed version exists. Sites without vdperanto installed can skip this.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":4534,"output_tokens":550,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the affected endpoints from the vendor or Wordfence/WPScan pages for CVE-2026-125847.","search":"'-125847':16A,19A '-2026':15A,18A '2.2':5A,36B,102C 'affect':97C 'allow':91C 'attack':57B 'chang':46B 'cross':7A,81C,92C 'cross-sit':6A,80C 'csrf':38B,85C 'cve':14A,17A 'describ':76B 'endpoint':73B 'fix':12A 'forgeri':10A,84C 'forgery.this':95C 'issu':96C 'lack':37B 'least':42B 'list':13A,67B 'log':50B 'logged-in':49B 'n/a':100C 'one':43B 'packag':21B 'page':59B 'patch':69B 'patchstack':66B 'privileg':52B 'protect':39B 'request':9A,47B,83C,94C 'site':8A,82C,93C 'sourc':79B 'state':45B 'state-chang':44B 'submit':64B 'theme':3A,27B,31B 'trick':62B 'user':53B 'vdperanto':1A,20A,22B,29B,89C,90C,98C 'version':35B,70B 'visit':55B 'vulner':72B,86C 'webriti':23B,33B,88C 'wordpress':2A,24B,26B,30B 'wordpress-them':25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the vdperanto plugin at version 2.2 or earlier are in scope according to the NVD entry. The sources do not say which request paths are exposed or whether a fixed version exists. Sites without vdperanto installed can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["vdperanto"],"ptokens":["vdperanto"],"labels":["high","package","vdperanto","vendor","webriti","wordpress","wordpresstheme"],"campaign_type":null,"search_a":"'-125847':16A,19A '-2026':15A,18A '2.2':5A 'cross':7A 'cross-sit':6A 'cve':14A,17A 'fix':12A 'forgeri':10A 'list':13A 'request':9A 'site':8A 'theme':3A 'vdperanto':1A,20A 'wordpress':2A","search_b":"'2.2':36B 'attack':57B 'chang':46B 'csrf':38B 'describ':76B 'endpoint':73B 'lack':37B 'least':42B 'list':67B 'log':50B 'logged-in':49B 'one':43B 'packag':21B 'page':59B 'patch':69B 'patchstack':66B 'privileg':52B 'protect':39B 'request':47B 'sourc':79B 'state':45B 'state-chang':44B 'submit':64B 'theme':27B,31B 'trick':62B 'user':53B 'vdperanto':22B,29B 'version':35B,70B 'visit':55B 'vulner':72B 'webriti':23B,33B 'wordpress':24B,26B,30B 'wordpress-them':25B","search_c":"'2.2':102C 'affect':97C 'allow':91C 'cross':81C,92C 'cross-sit':80C 'csrf':85C 'forgeri':84C 'forgery.this':95C 'issu':96C 'n/a':100C 'request':83C,94C 'site':82C,93C 'vdperanto':89C,90C,98C 'vulner':86C 'webriti':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T14:17:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125847","severity":null,"published_at":"2026-11-11T14:17:37+00:00","modified_at":"2026-11-11T14:17:37+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","fetched_at":"2026-11-11T14:27:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125847:3550","url":"https://patchstack.com/database/wordpress/theme/vdperanto","severity":null,"published_at":"2026-11-11T14:30:34+00:00","modified_at":"2026-11-11T14:30:34+00:00","first_seen_at":"2026-11-11T14:30:34+00:00","fetched_at":"2026-11-11T14:30:34+00:00","note":"Patchstack lists vdperanto as a WordPress THEME (not plugin), CSRF <= 2.2, 0 patched; no vendor advisory or fixed version found, no PoC or exploitation reported; endpoint unspecified. Nothing verified.","cites":["https://patchstack.com/database/wordpress/theme/vdperanto","https://cvefeed.io/vuln/detail/CVE-2026-125847"]}],"documents":[{"id":126226,"url":"https://patchstack.com/database/wordpress/theme/vdperanto","title":"vdperanto Vulnerabilities - Patchstack","kind":"advisory","source":"analyst","publisher":null,"text":"WordPress theme by Webriti. 1 present, 0 patched. CSRF <= 2.2.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":126228,"url":"https://cvefeed.io/vuln/detail/CVE-2026-125847","title":"CVE-2026-125847 - WordPress vdperanto theme <= 2.2 CSRF","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}