SHK-CORPORATE · CVE-2026-125849 · Package
NO FIX YET · SEE WHAT TO DO
Shk Corporate by webriti has a cross-site request forgery flaw in versions through 2.4.3. A malicious web page can make a logged-in user's browser send requests the site accepts, so an attacker can change settings or content without the user knowing.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Shk Corporate WordPress theme (webriti, about 400 active installs) at any version up to 2.4.3 are affected, which is every release so far. Exploitation needs a logged-in user, such as an admin, to visit an attacker-controlled page. Sites that don't have this theme installed can skip it.
Not affected if theme-not-installed
Who cares shk-corporate, webriti, wordpress, wordpress-theme
2.4.3 or lower is affected, and 2.4.3 is the newest release2.4.3 is still the latest release on WordPress.org and Patchstack lists 0 patchedCross-Site Request Forgery (CSRF) vulnerability in webriti Shk Corporate shk-corporate allows Cross Site Request Forgery.This issue affects Shk Corporate: from n/a through 2.4.3.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.