Is CVE-2026-125846 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125846 being exploited in the wild.

How severe is CVE-2026-125846?

High severity, with a CVSS score of 8.8, published 11 November 2026.

How is CVE-2026-125846 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-125846?

Check whether you run Webriti Mazino at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125846: webriti Mazino theme cross-site request forgery

CVE-2026-125846 · Severity: high · CVSS 8.8 · Published 2026-11-11

The Mazino WordPress theme is vulnerable to cross-site request forgery (CSRF), which allows attackers to trick logged-in administrators into performing unintended actions such as changing settings or creating unauthorized content. An attacker could craft a malicious webpage that, when visited by an administrator, automatically executes privileged actions on the victim's WordPress site without their knowledge or consent. This vulnerability affects Mazino theme version 1.1 and earlier, with no official patch currently available.

Vendors: Webriti.

Quick answers

Is CVE-2026-125846 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125846 being exploited in the wild.
How severe is CVE-2026-125846?: High severity, with a CVSS score of 8.8, published 11 November 2026.
Which products and versions are affected?: Webriti Mazino through 1.1.
Is there a fix for CVE-2026-125846?: No fixed version is recorded yet. Remove and replace the Mazino theme with an actively maintained alternative. Deactivating the theme alone does not eliminate the security threat; complete removal is required. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-125846 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-125846?: Check whether you run Webriti Mazino at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Remove and replace the Mazino theme with an actively maintained alternative. Deactivating the theme alone does not eliminate the security threat; complete removal is required.

Technical details

This CSRF vulnerability in the Mazino WordPress theme lacks proper nonce validation, allowing unauthenticated attackers to forge requests that execute actions on behalf of authenticated administrators. Exploitation requires user interaction (clicking a malicious link or visiting a crafted page) but no special privileges from the attacker. The theme has not received updates in 10 months and no official patch is available, making removal and replacement the primary remediation path.

Affected products

webriti Mazino through 1.1

Timeline

2026-10-10: disclosed
2026-11-11: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.