Webriti ElitePress theme: Cross-site request forgery

Summary

The ElitePress WordPress theme by Webriti, versions up to and including 3.2.1, contains a Cross-Site Request Forgery (CSRF) flaw. An attacker can trick a logged-in user, for example an administrator or editor, into visiting a malicious page that performs unintended actions on the site, such as changing settings or passwords. No account is needed for the attacker, but exploitation requires a victim to act (user interaction) and the impact depends on the victim's privileges.

Affected

• ElitePress WordPress theme up to and including 3.2.1
• Lower bound of the affected range: Unknown (listed as "n/a" in the CVE record)
• Product-status data in the CVE record is inconsistent and needs verification

Fixed in

• Unknown. No fixed version has been confirmed.
• Patchstack lists no official patch available.

Workaround

• Unknown. No vendor fix or confirmed workaround.
• Log out of WordPress when not working and use a separate browser profile for general web browsing.
• Restrict access to /wp-admin by IP address or VPN where feasible.
• Ask your hosting provider or WAF vendor whether a virtual patch for this issue exists.

Exploitation

• No evidence of exploitation in the wild found.
• No public proof of concept found.
• Not listed in the CISA KEV catalogue.

Our recommendation

• Check whether ElitePress is installed and active on your WordPress sites, including client sites.
• If it is in use, plan to replace it with a maintained theme, or obtain a fixed release from the vendor or Patchstack.
• Until then, limit administrator and editor access, enforce logout after use, and restrict /wp-admin where possible.
• Monitor the Patchstack entry and the vendor for updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• OffSeq radar entry CVE-2026-125839 radar.offseq.com
• Strix CVE entry CVE-2026-125839 www.strix.ai
• threatint CVE entry CVE-2026-125839 cve.threatint.com
• WordPress.org ElitePress theme page wordpress.org
• Wordfence threat intel ElitePress www.wordfence.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:26.