CVE-2026-125843: WordPress Spasalon theme <= 3.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in webriti Spasalon spasalon allows Cross Site Request Forgery.This issue affects Spasalon: from n/a through 3.0.
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must persuade a user to interact with a malicious request, as indicated by the required user interaction in the CVSS vector. The vulnerability can be reached over the network and does not require attacker privileges.
Which installations are affected?
Spasalon versions through 3.0 are affected. The available information does not identify a fixed version or state whether any particular default configuration changes exposure.
What should teams do if they cannot patch immediately?
The supplied data does not provide a vendor workaround or mitigation. Prioritize reducing the likelihood that users with access to the affected WordPress site follow untrusted links or interact with untrusted content until an update or vendor guidance is available.