Webriti Wallstreet WordPress theme: Cross-site request forgery

Summary

The Wallstreet WordPress theme by Webriti up to and including version 2.8.6 is affected by a cross-site request forgery (CSRF) vulnerability (CWE-352). An attacker can craft a malicious web page that triggers actions on a WordPress site in the context of a logged-in user, such as changing settings or passwords. Exploitation requires that a logged-in privileged user visits the attacker-controlled page; no authentication is required from the attacker.

Affected

• Webriti Wallstreet WordPress theme, all versions up to and including 2.8.6
• Earlier versions are presumably affected, not confirmed.

Fixed in

• Unknown. No fixed version or vendor advisory found.
• Patchstack lists no official patch available.

Workaround

• No vendor-published workaround found.
• Log out of WordPress admin when not working in it.
• Avoid browsing the web while logged into wp-admin.
• Use a WAF or virtual patching service if available.

Exploitation

• No evidence of exploitation in the wild found; not listed in CISA KEV.
• No public proof-of-concept known.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS 0.00143 (low).

Our recommendation

• Inventory all WordPress sites using Wallstreet, including child themes, and record versions.
• Check the Patchstack advisory and Webriti for a fixed release.
• If no fix is available, plan replacement with a supported theme or reduce administrator exposure.
• Review admin activity and user or settings changes on affected sites.
• Treat as high priority for sites with administrator logins.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• Rapid7 via Vulners vulners.com
• Strix AI CVE entry www.strix.ai
• MalCare: WordPress CSRF www.malcare.com
• TheHackerWire CVE entry www.thehackerwire.com
• WordPress.org Wallstreet theme wordpress.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:42.