CVE-2026-39718: Webriti Wallstreet cross-site request forgery

CVE-2026-39718 · Severity: high · CVSS 8.8 · Published 2026-10-02

Webriti Wallstreet is a WordPress theme used to build websites. A cross-site request forgery (CSRF) vulnerability allows attackers to trick logged-in administrators into unintentionally performing actions such as changing settings, deleting content, or modifying security configurations. An attacker could exploit this by sending a malicious link to a site administrator, potentially compromising the integrity and security of the affected website.

Vendors: Webriti.

Quick answers

Is CVE-2026-39718 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-39718 being exploited in the wild.
How severe is CVE-2026-39718?
High severity, with a CVSS score of 8.8, published 2 October 2026.
Which products and versions are affected?
Webriti Wallstreet through 2.8.6.
Is there a fix for CVE-2026-39718?
No fixed version is recorded yet. Remove and replace the Wallstreet theme with an alternative, as the vendor is unlikely to release further updates or security patches. Deactivating the theme alone does not remove the security threat; the theme must be deleted entirely from the WordPress installation.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-39718 attacked?
It is attacked over the network.
Am I affected by CVE-2026-39718?
Check whether you run Webriti Wallstreet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Remove and replace the Wallstreet theme with an alternative, as the vendor is unlikely to release further updates or security patches. Deactivating the theme alone does not remove the security threat; the theme must be deleted entirely from the WordPress installation.</anigation> </invoke>

Technical details

The Wallstreet WordPress theme through version 2.8.6 is vulnerable to cross-site request forgery attacks due to missing or insufficient CSRF token validation. Exploitation requires user interaction—specifically, a logged-in privileged user (such as an administrator) must visit a malicious page or click a crafted link. The attacker gains the ability to perform authenticated actions on behalf of the victim without their knowledge or consent.

Affected products

  • Webriti Wallstreet through 2.8.6

Timeline

  • 2026-08-26: disclosed: Reported by ashv4ni
  • 2026-10-02: advisory: Published by Patchstack

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.