webriti Rambo WordPress theme: Cross-site request forgery

Summary

The Rambo WordPress theme up to and including version 3.0 contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can trick a logged-in user, such as a site administrator, into visiting a malicious page that triggers unintended actions on the website. No account is needed by the attacker, but user interaction is required.

Affected

• webriti Rambo WordPress theme, versions up to and including 3.0

Fixed in

Unknown. No fixed version has been confirmed; the vendor's status is not known from the sources.

Workaround

• Unknown. No vendor workaround or virtual patch was found.
• Limit WordPress admin accounts to necessary users and have admins log out of the dashboard when browsing other sites.
• If the theme is not in use, replace it with a supported theme.

Exploitation

• Exploited in the wild: not known.
• Public proof of concept: none found.
• CISA KEV: not listed.

Our recommendation

• Check whether the Rambo theme is installed and which version is active on all WordPress sites, including other webriti products.
• Replace the theme with a supported alternative, as the vendor may not release further updates.
• Until a fix or replacement is in place, ask admins to avoid browsing other sites while logged in to the WordPress backend.
• Monitor the Patchstack and webriti pages for an update and verify the advisory before final prioritisation.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• OffSeq radar entry CVE-2026-125840 radar.offseq.com
• Strix CVE-2026-125840 www.strix.ai
• Threatint CVE-2026-125840 cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:26.