webriti Mazino: Cross-Site Request Forgery in WordPress theme

Summary

The Mazino WordPress theme up to and including version 1.1 is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick a logged-in user into clicking a crafted link or visiting a malicious page, which can make the user's browser perform unintended actions on the website, such as changing settings or passwords. The vendor has not published a patch, and the theme has not been updated for about ten months according to Patchstack.

Affected

• webriti Mazino WordPress theme, all versions up to and including 1.1
• Lower bound of the affected range is not specified ("n/a")

Fixed in

• Unknown. No patched version has been published according to Patchstack.

Workaround

• No vendor workaround known.
• If the theme is not essential, deactivate it; note that deactivation alone does not remove the threat unless a mitigation rule is in place.
• After any change, force a site-wide logout and check for unauthorised changes.

Exploitation

• No known exploitation in the wild.
• No public exploit available according to VulDB.
• CISA SSVC: exploitation none, automatable no, technical impact total.

Our recommendation

• Check whether the Mazino theme is installed and which version is active (theme folder "mazino").
• If installed, plan to replace it with a maintained theme or disable it.
• Restrict administrator logins and make users log out of the admin area before browsing unknown links.
• Monitor the Patchstack advisory for a fix.
• Audit recent administrative changes if exposure is suspected.
• Check other webriti themes in use, as same-day CVEs exist for them.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory CVE-2026-125846 patchstack.com
• CVE Record CVE-2026-125846 www.cve.org
• VulDB entry 435825 vuldb.com
• OffSeq radar CVE-2026-125846 radar.offseq.com
• CISA SSVC bulletin SB26-166 www.cisa.gov

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:25.