{"id":"CVE-2026-125849","kind":"vulnerability","aliases":["CVE-2026-125849"],"related":[],"title":"Shk Corporate WordPress theme: CSRF lets attackers act as logged-in admins","description":"Cross-Site Request Forgery (CSRF) vulnerability in webriti Shk Corporate shk-corporate allows Cross Site Request Forgery.This issue affects Shk Corporate: from n/a through 2.4.3.","summary":"Shk Corporate by webriti has a cross-site request forgery flaw in versions through 2.4.3. A malicious web page can make a logged-in user's browser send requests the site accepts, so an attacker can change settings or content without the user knowing.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"shk-corporate","fixed":[],"affected":"<= 2.4.3","ecosystem":"wordpress-theme"}],"ecosystems":[],"tags":["package","shk-corporate","webriti","wordpress","wordpress-theme"],"not_affected_if":["theme-not-installed"],"how_to_check":"In WordPress admin go to Appearance > Themes and look for Shk Corporate (a child theme of Appointment). Or read the Version line in wp-content/themes/shk-corporate/style.css. Version 2.4.3 or lower is affected, and 2.4.3 is the newest release.","fix":"No patched version exists: 2.4.3 is still the latest release on WordPress.org and Patchstack lists 0 patched. Remove and replace the theme, or switch to another theme.","status":"open","published_at":"2026-11-11T14:17:37+00:00","first_seen_at":"2026-11-11T14:27:32+00:00","triaged_at":"2026-11-11T14:29:08+00:00","updated_at":"2026-11-11T14:30:36+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T14:29:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Shk Corporate WordPress theme: CSRF lets attackers act as logged-in admins","impact":"medium","summary":"Shk Corporate by webriti has a cross-site request forgery flaw in versions through 2.4.3. A malicious web page can make a logged-in user's browser send requests the site accepts, so an attacker can change settings or content without the user knowing.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","shk-corporate","webriti"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker changes site settings or content as a logged-in admin","analyst_note":"Find the fixed version of shk-corporate after 2.4.3 and confirm the affected platform (WordPress theme) at the NVD entry.","how_to_check":"- Look for the `shk-corporate` theme in the WordPress Appearance > Themes list and note its version\n- Check the `Version` header in the theme's `style.css` file\n- unknown for any other check, as the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["theme-not-installed"],"who_is_affected":"Sites running the Shk Corporate theme at version 2.4.3 or earlier are affected, per the sources. Exposure needs a logged-in administrator to visit an attacker-controlled page. Sites not using this theme can skip it; the sources do not say which version fixes it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000737,"input_tokens":4544,"output_tokens":565,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version of shk-corporate after 2.4.3 and confirm the affected platform (WordPress theme) at the NVD entry.","search":"'-125849':16A,19A '-2026':15A,18A '2.4.3':47B,104C 'accept':65B 'act':8A 'admin':13A 'affect':98C 'allow':92C 'attack':7A,68B 'browser':60B 'chang':70B 'content':73B 'corpor':2A,26B,33B,88C,91C,100C 'corporate':22A 'cross':39B,79C,93C 'cross-sit':38B,78C 'csrf':5A,83C 'cve':14A,17A 'flaw':43B 'forgeri':42B,82C 'forgery.this':96C 'issu':97C 'know':77B 'let':6A 'log':11A,56B 'logged-in':10A,55B 'make':53B 'malici':49B 'n/a':102C 'packag':23B 'page':51B 'request':41B,62B,81C,95C 'send':61B 'set':71B 'shk':1A,21A,25B,32B,87C,90C,99C 'shk-corpor':24B,89C 'shk-corporate':20A 'site':40B,64B,80C,94C 'theme':4A,31B 'user':58B,76B 'version':45B 'vulner':84C 'web':50B 'webriti':27B,35B,86C 'without':74B 'wordpress':3A,28B,30B 'wordpress-them':29B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Shk Corporate WordPress theme (webriti, about 400 active installs) at any version up to 2.4.3 are affected, which is every release so far. Exploitation needs a logged-in user, such as an admin, to visit an attacker-controlled page. Sites that don't have this theme installed can skip it.","tier":"B","verified":{"products":{"at":"2026-11-11T14:30:36Z","by":"analyst","doc":"https://patchstack.com/database/wordpress/theme/shk-corporate/vulnerabilities","run_id":3548}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["shkcorporate"],"ptokens":["corporate","shk"],"labels":["high","package","shkcorporate","webriti","wordpress","wordpresstheme"],"campaign_type":null,"search_a":"'-125849':16A,19A '-2026':15A,18A 'act':8A 'admin':13A 'attack':7A 'corpor':2A 'corporate':22A 'csrf':5A 'cve':14A,17A 'let':6A 'log':11A 'logged-in':10A 'shk':1A,21A 'shk-corporate':20A 'theme':4A 'wordpress':3A","search_b":"'2.4.3':47B 'accept':65B 'attack':68B 'browser':60B 'chang':70B 'content':73B 'corpor':26B,33B 'cross':39B 'cross-sit':38B 'flaw':43B 'forgeri':42B 'know':77B 'log':56B 'logged-in':55B 'make':53B 'malici':49B 'packag':23B 'page':51B 'request':41B,62B 'send':61B 'set':71B 'shk':25B,32B 'shk-corpor':24B 'site':40B,64B 'theme':31B 'user':58B,76B 'version':45B 'web':50B 'webriti':27B,35B 'without':74B 'wordpress':28B,30B 'wordpress-them':29B","search_c":"'2.4.3':104C 'affect':98C 'allow':92C 'corpor':88C,91C,100C 'cross':79C,93C 'cross-sit':78C 'csrf':83C 'forgeri':82C 'forgery.this':96C 'issu':97C 'n/a':102C 'request':81C,95C 'shk':87C,90C,99C 'shk-corpor':89C 'site':80C,94C 'vulner':84C 'webriti':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T14:17:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125849","severity":null,"published_at":"2026-11-11T14:17:37+00:00","modified_at":"2026-11-11T14:17:37+00:00","first_seen_at":"2026-11-11T14:27:32+00:00","fetched_at":"2026-11-11T14:27:32+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125849:3548","url":"https://wordpress.org/themes/shk-corporate/","severity":null,"published_at":"2026-11-11T14:30:36+00:00","modified_at":"2026-11-11T14:30:36+00:00","first_seen_at":"2026-11-11T14:30:36+00:00","fetched_at":"2026-11-11T14:30:36+00:00","note":"NVD/Patchstack: CSRF <= 2.4.3; WordPress.org latest is 2.4.3 and Patchstack shows 0 patched, so no fix exists. Not verified: vendor has no advisory; the sources are third-party.","cites":["https://wordpress.org/themes/shk-corporate/","https://patchstack.com/database/wordpress/theme/shk-corporate/vulnerabilities"]}],"documents":[{"id":126229,"url":"https://wordpress.org/themes/shk-corporate/","title":"Shk Corporate – WordPress.org theme page (latest 2.4.3)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":126230,"url":"https://patchstack.com/database/wordpress/theme/shk-corporate/vulnerabilities","title":"Shk Corporate vulnerabilities - Patchstack (CSRF <= 2.4.3, 0 patched)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}