# CVE-2026-57690: Fuelthemes Werkstatt CSRF in WordPress theme

Source: https://junglewise.ai/threats/cve-2026-57690-fuelthemes-werkstatt-csrf-in-wordpress-theme  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-57690 · Severity: medium · CVSS 4.3 · Published 2026-07-02

Werkstatt, a premium WordPress theme, contains a security flaw that could allow an attacker to trick a site administrator into performing unintended actions. By persuading a logged-in user to click a malicious link or visit a specially crafted webpage, an attacker could modify site settings or data without the user's knowledge. This could lead to unauthorized changes to the website's configuration or content.

## Quick answers

**Is CVE-2026-57690 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57690 being exploited in the wild.

**How severe is CVE-2026-57690?** Medium severity, with a CVSS score of 4.3, published 2 July 2026.

**Which products and versions are affected?** Fuelthemes Werkstatt <= 4.7.2.

**Is there a fix for CVE-2026-57690?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57690 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-57690?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Fuelthemes Werkstatt theme for WordPress through version 4.7.2. The issue stems from a lack of proper nonce validation or equivalent CSRF protections on sensitive state-changing functions within the theme. An unauthenticated remote attacker can exploit this by crafting a malicious request and tricking a logged-in administrator into executing it via social engineering (e.g., a malicious link or hidden form). Successful exploitation allows the attacker to perform unauthorized actions with the privileges of the victim user, potentially altering site settings. As of the advisory date, no official patch has been released.

## Affected products

- Fuelthemes Werkstatt <= 4.7.2

## Timeline

- 2024-09-17: other: Vulnerability reported by researcher
- 2026-06-29: advisory: Initial advisory published by Patchstack
- 2026-07-02: disclosed: CVE published in NVD

## References

- [https://patchstack.com/database/wordpress/theme/werkstatt/vulnerability/wordpress-werkstatt-theme-4-7-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/theme/werkstatt/vulnerability/wordpress-werkstatt-theme-4-7-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve)