Quick answers
- Is CVE-2026-125843 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-125843 being exploited in the wild.
- How severe is CVE-2026-125843?
- High severity, with a CVSS score of 8.8, published 11 November 2026.
- Which products and versions are affected?
- Webriti Spasalon through 3.0.
- Is there a fix for CVE-2026-125843?
- No fixed version is recorded yet. Remove and replace the Spasalon theme with an alternative, as the vendor is unlikely to release security patches. Deactivating the theme without removal does not eliminate the security threat. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-125843 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-125843?
- Check whether you run Webriti Spasalon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Remove and replace the Spasalon theme with an alternative, as the vendor is unlikely to release security patches. Deactivating the theme without removal does not eliminate the security threat.
Technical details
A CSRF vulnerability exists in Spasalon theme versions through 3.0 that lacks proper nonce verification on state-changing operations. The vulnerability requires user interaction (a logged-in user clicking a malicious link or visiting a crafted page) but can be triggered by an unauthenticated attacker. No official patch is available; the theme was last updated two months prior to disclosure and is unlikely to receive further updates.
Affected products
- webriti Spasalon through 3.0
Timeline
- 2026-10-10: disclosed
- 2026-11-11: advisory