webriti vice WordPress theme: Cross-site request forgery

Summary

The WordPress theme vice by webriti, versions up to and including 1.4, is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can craft a malicious web page that causes a logged-in user, typically an administrator, to perform unintended actions on the website, such as changing settings or passwords. Exploitation requires that the victim visits the malicious page while logged in.

Affected

• webriti vice WordPress theme, all versions up to and including 1.4
• Versions from 0 through 1.4 according to the CVE record

Fixed in

Unknown. No patched version has been published at the time of writing.

Workaround

Unknown. No vendor workaround is known. General CSRF protections such as anti-CSRF tokens and POST-only sensitive actions are expected to help, but this has not been confirmed for vice.

Exploitation

• No known exploitation in the wild.
• No public proof-of-concept exploit found.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Inventory all client websites and check whether the vice theme is installed and which version is used.
• If the theme is unused, deactivate and remove it.
• If it is in use, monitor the Patchstack advisory and apply a fixed release as soon as one is available.
• Until a fix exists, limit administrator logins, have administrators log out before browsing other sites, and use a WAF or virtual patching where available.
• Consider replacing the theme, as the vendor is unlikely to publish further updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory: WordPress vice theme <= 1.4 CSRF patchstack.com
• CVE Record CVE-2026-125844 www.cve.org
• OffSeq Radar: CVE-2026-125844 radar.offseq.com
• Threatint: CVE-2026-125844 cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:24.