CVE-2026-125845: WordPress vdequator theme <= 1.2.7 - Cross Site Request Forgery (CSRF) vulnerability

Q: What does an attacker need to exploit this issue?

An attacker can exploit the CSRF issue remotely without authentication, but a victim must interact with an attacker-controlled request, such as by visiting a malicious page or following a crafted link.

Q: Which versions are affected?

The affected range is vdequator versions through 1.2.7. No fixed version is identified in the provided information.

Q: What should teams do if no patched version is available?

The provided information does not list a workaround. Until a fix is confirmed, reduce exposure by limiting administrative access and cautioning authenticated site users against opening untrusted links or pages.

Published Nov 11, 2026

Updated

Cross-Site Request Forgery (CSRF) vulnerability in webriti vdequator vdequator allows Cross Site Request Forgery.This issue affects vdequator: from n/a through 1.2.7.

Event History

Nov 11, 2026

CVE Published

via MITRE·01:24 PM

Data Sourced

via MITRE·01:24 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker can exploit the CSRF issue remotely without authentication, but a victim must interact with an attacker-controlled request, such as by visiting a malicious page or following a crafted link.

Which versions are affected?

The affected range is vdequator versions through 1.2.7. No fixed version is identified in the provided information.

What should teams do if no patched version is available?