{"id":"CVE-2026-125848","kind":"vulnerability","aliases":["CVE-2026-125848"],"related":[],"title":"Leo WordPress theme (webriti) up to 1.7.4: CSRF lets attackers trigger actions as a logged-in user, no fix","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti Leo leo allows Cross Site Request Forgery.This issue affects Leo: from n/a through 1.7.4.","summary":"Leo is a small WordPress business theme by webriti, a child of the Wallstreet theme. Versions up to and including 1.7.4 lack request validation (CSRF), so a crafted link or page can make a logged-in user's browser perform actions on the site. Patchstack reports no official patch; 1.7.4 is still the newest version on WordPress.org. No exploitation has been reported.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"leo","fixed":[],"affected":"<= 1.7.4","ecosystem":"wordpress-theme"}],"ecosystems":[],"tags":["csrf","leo","other","webriti","wordpress","wordpress-theme"],"not_affected_if":["not-installed"],"how_to_check":"In WordPress admin go to Appearance > Themes and check whether Leo is installed or active and its version. Or run: wp theme list (look for leo, version <= 1.7.4). Also check whether a Leo child theme or copy is on the site, since deactivating the theme may not remove the risk.","fix":"No fixed version known: Patchstack says no official patch, and WordPress.org lists 1.7.4 as the latest. Replace the theme with a maintained one; until then keep admins from browsing untrusted pages while logged in.","status":"open","published_at":"2026-11-11T14:17:37+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","triaged_at":"2026-11-11T14:29:08+00:00","updated_at":"2026-11-11T14:30:31+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-11T14:29:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Leo theme by webriti: cross-site request forgery lets attackers act as users","impact":"medium","summary":"The Leo product by webriti has a cross-site request forgery flaw affecting versions through 1.7.4. An attacker can trick a logged-in user's browser into sending requests the site accepts, performing actions as that user.","audience":"businesses","category":"other","nicknames":[],"who_cares":["leo","webriti","wordpress"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Logged-in users' actions performed through forged requests","analyst_note":"Confirm what Leo is (likely a WordPress theme) and whether a fixed version exists beyond 1.7.4; check the NVD page and vendor advisory.","how_to_check":"- Check the installed Leo version against the affected range (through `1.7.4`)\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000661,"input_tokens":4532,"output_tokens":416,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm what Leo is (likely a WordPress theme) and whether a fixed version exists beyond 1.7.4; check the NVD page and vendor advisory.","search":"'-125848':23A,26A '-2026':22A,25A '1.7.4':7A,56B,86B,121C 'action':12A,77B 'affect':116C 'allow':110C 'attack':10A 'browser':75B 'busi':41B 'child':46B 'craft':63B 'cross':100C,111C 'cross-sit':99C 'csrf':8A,28B,60B,104C 'cve':21A,24A 'exploit':95B 'fix':20A 'forgeri':103C 'forgery.this':114C 'includ':55B 'issu':115C 'lack':57B 'leo':1A,27A,29B,36B,108C,109C,117C 'let':9A 'link':64B 'log':16A,71B 'logged-in':15A,70B 'make':68B 'n/a':119C 'newest':90B 'offici':84B 'page':66B 'patch':85B 'patchstack':81B 'perform':76B 'report':82B,98B 'request':58B,102C,113C 'site':80B,101C,112C 'small':39B 'still':88B 'theme':3A,35B,42B,50B 'trigger':11A 'user':18A,73B 'valid':59B 'version':51B,91B 'vulner':105C 'wallstreet':49B 'webriti':4A,31B,44B,107C 'wordpress':2A,32B,34B,40B 'wordpress-them':33B 'wordpress.org':93B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites that have the Leo theme by webriti installed, version 1.7.4 or earlier. An attacker needs a logged-in user (likely an admin) to open a crafted page or link. Sites that do not use Leo can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["leo"],"ptokens":["leo"],"labels":["csrf","high","leo","other","webriti","wordpress","wordpresstheme"],"campaign_type":null,"search_a":"'-125848':23A,26A '-2026':22A,25A '1.7.4':7A 'action':12A 'attack':10A 'csrf':8A 'cve':21A,24A 'fix':20A 'leo':1A,27A 'let':9A 'log':16A 'logged-in':15A 'theme':3A 'trigger':11A 'user':18A 'webriti':4A 'wordpress':2A","search_b":"'1.7.4':56B,86B 'action':77B 'browser':75B 'busi':41B 'child':46B 'craft':63B 'csrf':28B,60B 'exploit':95B 'includ':55B 'lack':57B 'leo':29B,36B 'link':64B 'log':71B 'logged-in':70B 'make':68B 'newest':90B 'offici':84B 'page':66B 'patch':85B 'patchstack':81B 'perform':76B 'report':82B,98B 'request':58B 'site':80B 'small':39B 'still':88B 'theme':35B,42B,50B 'user':73B 'valid':59B 'version':51B,91B 'wallstreet':49B 'webriti':31B,44B 'wordpress':32B,34B,40B 'wordpress-them':33B 'wordpress.org':93B","search_c":"'1.7.4':121C 'affect':116C 'allow':110C 'cross':100C,111C 'cross-sit':99C 'csrf':104C 'forgeri':103C 'forgery.this':114C 'issu':115C 'leo':108C,109C,117C 'n/a':119C 'request':102C,113C 'site':101C,112C 'vulner':105C 'webriti':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T14:17:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125848","severity":null,"published_at":"2026-11-11T14:17:37+00:00","modified_at":"2026-11-11T14:17:37+00:00","first_seen_at":"2026-11-11T14:27:31+00:00","fetched_at":"2026-11-11T14:27:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125848:3549","url":"https://patchstack.com/database/wordpress/theme/leo/vulnerability/wordpress-leo-theme-1-7-4-cross-site-request-forgery-csrf-vulnerability","severity":null,"published_at":"2026-11-11T14:30:31+00:00","modified_at":"2026-11-11T14:30:31+00:00","first_seen_at":"2026-11-11T14:30:31+00:00","fetched_at":"2026-11-11T14:30:31+00:00","note":"Leo is a WordPress.org child theme of Wallstreet by webriti (300+ installs). Patchstack: <=1.7.4 CSRF, no official patch; WP.org still lists 1.7.4 as latest (updated 2026-06-05). No exploitation or PoC seen; Patchstack rates low priority. Nothing marked verified (no vendor advisory). Sibling webriti themes (Wallstreet CVE-2026-39718, Appointment Dark, Shk Corporate) have the same class of bug.","cites":["https://patchstack.com/database/wordpress/theme/leo/vulnerability/wordpress-leo-theme-1-7-4-cross-site-request-forgery-csrf-vulnerability","https://wordpress.org/themes/leo/"]}],"documents":[{"id":126225,"url":"https://patchstack.com/database/wordpress/theme/leo/vulnerability/wordpress-leo-theme-1-7-4-cross-site-request-forgery-csrf-vulnerability","title":"Patchstack: WordPress Leo Theme <= 1.7.4 CSRF","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":126227,"url":"https://wordpress.org/themes/leo/","title":"Leo theme on WordPress.org (webriti), version 1.7.4","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}