CVE-2026-125841: WordPress Heroic theme <= 1.4.2 - Cross Site Request Forgery (CSRF) vulnerability

Q: Which installations are affected?

Heroic theme installations are affected through version 1.4.2. The available data does not identify a fixed version.

Q: What does an attacker need to exploit this issue?

The attack vector is network-based, requires low attack complexity, and does not require attacker privileges. It does require user interaction, consistent with a CSRF attack.

Q: What is the potential impact if exploitation succeeds?

The vulnerability is rated high severity with a CVSS score of 8.8. It can result in high impact to confidentiality, integrity, and availability.

Published Nov 11, 2026

Updated

Cross-Site Request Forgery (CSRF) vulnerability in webriti Heroic heroic allows Cross Site Request Forgery.This issue affects Heroic: from n/a through 1.4.2.

Event History

Nov 11, 2026

CVE Published

via MITRE·01:44 PM

Data Sourced

via MITRE·01:44 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Heroic theme installations are affected through version 1.4.2. The available data does not identify a fixed version.

What does an attacker need to exploit this issue?

The attack vector is network-based, requires low attack complexity, and does not require attacker privileges. It does require user interaction, consistent with a CSRF attack.

What is the potential impact if exploitation succeeds?

The vulnerability is rated high severity with a CVSS score of 8.8. It can result in high impact to confidentiality, integrity, and availability.

CVE-2026-125841: WordPress Heroic theme <= 1.4.2 - Cross Site Request Forgery (CSRF) vulnerability

Event History

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?