Spasalon WordPress theme: Cross-site request forgery (CSRF)

Summary

The Spasalon WordPress theme by webriti, versions 3.0 and earlier, is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can craft a malicious web page that makes a logged-in privileged user perform unintended actions on the website, such as changing settings or passwords. Exploitation requires the victim to visit the attacker-controlled page while logged in, and the attacker needs no account. The CNA (Patchstack) rates it CVSS 8.8, while VulDB rates it 4.3 (medium), and Patchstack assigns low priority.

Affected

• webriti Spasalon WordPress theme, versions from 0 through 3.0
• Theme classification confirmed by CVE record and Patchstack (VulDB lists it as a plugin)

Fixed in

Unknown. No vendor advisory or fixed release has been found. Patchstack states: No official patch available.

Workaround

• Check whether any site runs the Spasalon theme, including child themes.
• Until a fix exists, admins log out after editing, use a dedicated browser profile for administration, and avoid browsing other sites in the same session.
• Limit the number of administrator and editor accounts.
• Consider replacing the theme with a maintained one if no fix is released.
• A virtual patch or WAF rule may help; no source confirms one exists for this CVE.

Exploitation

• No evidence of exploitation in the wild (OffSeq: Not known to be exploited).
• No public proof of concept found (VulDB: no available exploit).
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.

Our recommendation

• Check whether Spasalon is installed on any website and add it to the patch list.
• Apply the workarounds above, especially on sites with several administrators.
• Monitor the Patchstack entry and the WordPress.org theme page for a fixed release, and replace the theme if none is published.
• Monitor the website for unexpected configuration changes or new administrator accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-125843 www.cve.org
• Patchstack: WordPress Spasalon theme <= 3.0 CSRF patchstack.com
• VulDB entry 435823 vuldb.com
• OffSeq threat radar entry CVE-2026-125843 radar.offseq.com
• WordPress.org: Spasalon theme wordpress.org
• webriti: SpaSalon product page webriti.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:23.