Is CVE-2026-125847 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-125847 being exploited in the wild.

How severe is CVE-2026-125847?

High severity, with a CVSS score of 8.8, published 11 November 2026.

Which products and versions are affected?

Webriti Vdperanto 2.2 and earlier.

Is there a fix for CVE-2026-125847?

No fixed version is recorded yet. Remove and replace the vdperanto theme immediately. Since the theme is no longer maintained and unlikely to receive patches, switching to an actively maintained alternative is the recommended course of action. [{"kind": "disclosed", "at": "2026-10-10", "note": "Vulnerability reported to Patchstack"}, {"kind": "advisory", "at": "2026-11-11", "note": "Published by Patchstack"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-125847 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-125847?

Check whether you run Webriti Vdperanto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-125847: webriti vdperanto theme cross-site request forgery

CVE-2026-125847 · Severity: high · CVSS 8.8 · Published 2026-11-11

The vdperanto WordPress theme is vulnerable to cross-site request forgery (CSRF), allowing attackers to trick logged-in administrators into performing unintended actions such as changing settings, creating accounts, or modifying site content. An attacker can craft a malicious webpage that, when visited by an authenticated administrator, silently executes administrative functions without the user's knowledge. This vulnerability affects vdperanto theme version 2.2 and earlier, with no official patch available.

Vendors: Webriti.

Quick answers

Is CVE-2026-125847 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-125847 being exploited in the wild.
How severe is CVE-2026-125847?: High severity, with a CVSS score of 8.8, published 11 November 2026.
Which products and versions are affected?: Webriti Vdperanto 2.2 and earlier.
Is there a fix for CVE-2026-125847?: No fixed version is recorded yet. Remove and replace the vdperanto theme immediately. Since the theme is no longer maintained and unlikely to receive patches, switching to an actively maintained alternative is the recommended course of action.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-10", "note": "Vulnerability reported to Patchstack"}, {"kind": "advisory", "at": "2026-11-11", "note": "Published by Patchstack"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-125847 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-125847?: Check whether you run Webriti Vdperanto at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Remove and replace the vdperanto theme immediately. Since the theme is no longer maintained and unlikely to receive patches, switching to an actively maintained alternative is the recommended course of action.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-10", "note": "Vulnerability reported to Patchstack"}, {"kind": "advisory", "at": "2026-11-11", "note": "Published by Patchstack"}]

Technical details

The vdperanto WordPress theme lacks proper CSRF token validation, allowing unauthenticated attackers to forge requests that execute actions on behalf of authenticated users. Exploitation requires user interaction—a logged-in administrator must visit a malicious page or click a crafted link—but no elevated privileges are needed to trigger the attack. The vulnerability allows modification of sensitive site configurations or data.

Affected products

webriti vdperanto 2.2 and earlier

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.