Is CVE-2026-125841 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125841 being exploited in the wild.

How severe is CVE-2026-125841?

High severity, with a CVSS score of 8.8, published 11 November 2026.

Is there a fix for CVE-2026-125841?

No fixed version is recorded yet. Remove and replace the Heroic theme with an actively maintained alternative; deactivating the theme alone does not remove the security threat. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-125841 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-125841?

Check whether you run Webriti Heroic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125841: Heroic WordPress theme cross-site request forgery

CVE-2026-125841 · Severity: high · CVSS 8.8 · Published 2026-11-11

The Heroic WordPress theme is vulnerable to cross-site request forgery (CSRF), allowing attackers to trick logged-in administrators into performing unintended actions such as changing passwords, modifying settings, or making configuration changes. An attacker can craft a malicious webpage or email that, when visited by an authenticated site administrator, executes unwanted administrative actions without the user's knowledge or consent. This affects theme versions up to 1.4.2, and the theme has not received official patches or updates in over a year.

Vendors: Webriti.

Quick answers

Is CVE-2026-125841 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125841 being exploited in the wild.
How severe is CVE-2026-125841?: High severity, with a CVSS score of 8.8, published 11 November 2026.
Which products and versions are affected?: Webriti Heroic through 1.4.2.
Is there a fix for CVE-2026-125841?: No fixed version is recorded yet. Remove and replace the Heroic theme with an actively maintained alternative; deactivating the theme alone does not remove the security threat. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-125841 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-125841?: Check whether you run Webriti Heroic at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Remove and replace the Heroic theme with an actively maintained alternative; deactivating the theme alone does not remove the security threat.

Technical details

The Heroic theme lacks proper CSRF token validation on state-changing operations, allowing unauthenticated attackers to craft cross-site requests that execute administrative actions when a logged-in user visits a malicious page. The vulnerability requires user interaction (the administrator must click a link or visit a malicious site) but succeeds against any privileged user once they are tricked. The theme is unmaintained and no official patch is available.

Affected products

webriti Heroic through 1.4.2

Timeline

2026-10-09: disclosed
2026-11-11: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.