webriti Appointment Dark: Cross-Site Request Forgery (CSRF) in WordPress theme

Summary

The webriti Appointment Dark WordPress theme, up to and including version 1.3.4, is affected by Cross-Site Request Forgery (CSRF). An attacker can lure a logged-in user with rights on the website to a crafted page, which then triggers unintended actions in the user's name, such as changing settings or passwords. No authentication is needed by the attacker, but a victim must be logged in and visit the malicious page. No vendor patch is known, and Patchstack recommends removing the theme.

Affected

• Appointment Dark theme (WordPress), versions up to and including 1.3.4
• Lower bound of the affected range unclear (listed as 0 or n/a by different sources)

Fixed in

Unknown. No fixed version or vendor advisory found. 1.3.4 is the latest version listed on WordPress.org.

Workaround

• No vendor workaround published.
• Log out of WordPress after administration and do not browse other sites in the same session.
• Use a separate browser profile for administration.
• Restrict access to the admin area by IP address or VPN where possible.
• Replace the theme with a maintained alternative if it is not needed.

Exploitation

• Not known to be exploited in the wild.
• No public exploit found.
• CISA SSVC: exploitation none, not automatable, total technical impact.
• VulDB temporary score: 4.3 (Medium). Patchstack and the CNA score: 8.8 (High, CVSS 3.1, UI:R).

Our recommendation

• Check whether the Appointment Dark theme is installed on your websites.
• If installed, replace it with a maintained theme, as no fix is available.
• Until then, restrict backend access, limit administrator and editor accounts, and log out after administration.
• Monitor the vendor and the WordPress.org page for a fixed version and check for newer releases before closing this item.
• Raise the priority if the site handles bookings or customer data.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory: Appointment Dark theme CSRF patchstack.com
• CVE Record CVE-2026-125850 www.cve.org
• VulDB entry 435821 vuldb.com
• OffSeq threat radar: CVE-2026-125850 radar.offseq.com
• WordPress.org: Appointment Dark theme wordpress.org
• webriti: Appointment Dark product page webriti.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:22.