CVE-2026-125850: webriti Appointment Dark cross-site request forgery

CVE-2026-125850 · Severity: high · CVSS 8.8 · Published 2026-11-11

The Appointment Dark WordPress theme contains a CSRF vulnerability that allows attackers to trick logged-in administrators into performing unintended actions, such as modifying site settings or deleting content. An attacker can craft a malicious webpage or email that, when visited by an authenticated user, executes unwanted commands on the website without the user's knowledge or consent. This vulnerability affects all versions through 1.3.4, and the vendor has not released a patch.

Vendors: Webriti.

Quick answers

Is CVE-2026-125850 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-125850 being exploited in the wild.
How severe is CVE-2026-125850?
High severity, with a CVSS score of 8.8, published 11 November 2026.
Which products and versions are affected?
Webriti Appointment Dark 1.3.4 and earlier.
Is there a fix for CVE-2026-125850?
No fixed version is recorded yet. Remove and replace the Appointment Dark theme with an alternative, as the vendor is unlikely to issue patches given the long time since the last update. Ensure your WordPress installation is kept fully patched and consider using a Web Application Firewall to detect and block suspicious cross-origin requests. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-125850 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-125850?
Check whether you run Webriti Appointment Dark at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Remove and replace the Appointment Dark theme with an alternative, as the vendor is unlikely to issue patches given the long time since the last update. Ensure your WordPress installation is kept fully patched and consider using a Web Application Firewall to detect and block suspicious cross-origin requests.

Technical details

This is a classic cross-site request forgery (CSRF) vulnerability in which the Appointment Dark theme fails to implement or validate CSRF tokens on state-changing operations. An unauthenticated attacker can craft a malicious request that, when a logged-in admin visits a page under attacker control, will execute arbitrary actions with the victim's privileges. The attack requires user interaction (visiting a malicious link or page) but no authentication from the attacker.

Affected products

  • webriti Appointment Dark 1.3.4 and earlier

Timeline

  • 2026-10-10: disclosed
  • 2026-11-11: advisory: Patchstack published advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.