---
id: "CVE-2026-125847"
page: "https://infrastack.ai/live/CVE-2026-125847"
kind: "vulnerability"
aliases: ["CVE-2026-125847"]
title: "vdperanto WordPress theme through 2.2: cross-site request forgery, no fix listed"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "vdperanto", "fixed": [], "affected": "<= 2.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["package", "vdperanto", "webriti", "wordpress", "wordpress-theme"]
not_affected_if: ["managed-hosting-with-theme-absent", "plugin-not-installed", "theme-not-installed"]
published_at: "2026-11-11T14:17:37+00:00"
first_seen_at: "2026-11-11T14:27:31+00:00"
updated_at: "2026-11-11T14:30:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125847", "first_seen_at": "2026-11-11T14:27:31+00:00"}, {"source": "analyst", "url": "https://patchstack.com/database/wordpress/theme/vdperanto", "first_seen_at": "2026-11-11T14:30:34+00:00", "cites": ["https://patchstack.com/database/wordpress/theme/vdperanto", "https://cvefeed.io/vuln/detail/CVE-2026-125847"]}]
exploit_sources: []
---

# vdperanto WordPress theme through 2.2: cross-site request forgery, no fix listed

Link for people: https://infrastack.ai/live/CVE-2026-125847 (this .md is for agents)

The vdperanto WordPress theme by Webriti, through version 2.2, lacks CSRF protection on at least one state-changing request. A logged-in privileged user who visits an attacker's page can be tricked into submitting it. Patchstack lists no patched version; the vulnerable endpoint is not described in the sources.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:vdperanto affected <= 2.2 fixed no fixed version listed

## How to check

- In WordPress admin go to Appearance > Themes and read the vdperanto version, or check wp-content/themes/vdperanto/style.css (Version header).
- Version 2.2 or lower is in the affected range.

## Fix

No fixed version published as of 2026-11-11 per Patchstack (0 patched). Until then, switch to another theme or remove vdperanto if unused; admins should log out of wp-admin before browsing elsewhere.

## Timeline

- 2026-11-11T14:27:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125847
- 2026-11-11T14:30:34+00:00 analyst https://patchstack.com/database/wordpress/theme/vdperanto — Patchstack lists vdperanto as a WordPress THEME (not plugin), CSRF <= 2.2, 0 patched; no vendor advisory or fixed version found, no PoC or exploitation reported; endpoint unspecified. Nothing verified.

## Documents

- [advisory] vdperanto Vulnerabilities - Patchstack https://patchstack.com/database/wordpress/theme/vdperanto
- [mentions] CVE-2026-125847 - WordPress vdperanto theme <= 2.2 CSRF https://cvefeed.io/vuln/detail/CVE-2026-125847

## From the sources

Cross-Site Request Forgery (CSRF) vulnerability in webriti vdperanto vdperanto allows Cross Site Request Forgery.This issue affects vdperanto: from n/a through 2.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_