Shk Corporate WordPress theme: Cross-Site Request Forgery in theme
Summary
The Shk Corporate WordPress theme up to and including version 2.4.3 is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can craft a malicious web page that causes a logged-in administrator or editor to perform unintended actions on the WordPress site, such as changing settings or passwords. The attack requires that the victim visits the attacker's page while logged in, and no fixed version has been published.
Affected
- webriti Shk Corporate WordPress theme, versions up to and including 2.4.3
- Parent theme Appointment is not covered by this CVE
Fixed in
Unknown. No patched version has been confirmed by the vendor or Patchstack. The current WordPress.org release 2.4.3 is presumably still affected.
Workaround
- No vendor workaround confirmed.
- Log out of WordPress admin when browsing other sites; use a separate browser profile for admin work.
- Restrict admin access by IP address or VPN where feasible.
- Consider a WAF or virtual patching service.
Exploitation
- Not known to be exploited in the wild as of publication.
- No public proof of concept, Metasploit module or Nuclei template found.
- Patchstack rates the priority as low; CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether the Shk Corporate theme is installed and which version is active.
- Reduce admin session exposure: log out after admin work and avoid browsing other sites in the same session.
- Monitor for a fixed release or vendor advisory and update as soon as one is available.
- If the theme is not needed, replace it with a maintained theme.
- Keep WordPress core and all other plugins and themes up to date.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- CVE Record CVE-2026-125849 www.cve.org
- VulDB entry 435827 vuldb.com
- OffSeq Radar CVE-2026-125849 radar.offseq.com
- WordPress.org theme listing Shk Corporate wordpress.org
- ThemeDetect Shk Corporate www.themedetect.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:21.
Original description (NVD)
Cross-Site Request Forgery (CSRF) vulnerability in webriti Shk Corporate shk-corporate allows Cross Site Request Forgery.This issue affects Shk Corporate: from n/a through 2.4.3.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.