CVE-2026-125850 · Package
NO FIX YET · SEE WHAT TO DO
Appointment Dark, a WordPress theme by webriti, has a cross-site request forgery flaw in versions through 1.3.4. A logged-in user who opens a malicious page can be tricked into sending requests the site accepts as their own.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Appointment Dark WordPress theme at version 1.3.4 or earlier. Exposure depends on whether logged-in users, especially administrators, can be lured to a malicious page while signed in; sites not using this theme can skip it.
Not affected if theme-not-installed
Who cares appointment-dark, webriti, wordpress
style.css of the appointment-dark theme folder.1.3.4 or earlier.Cross-Site Request Forgery (CSRF) vulnerability in webriti Appointment Dark appointment-dark allows Cross Site Request Forgery.This issue affects Appointment Dark: from n/a through 1.3.4.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.