CVE-2026-125850: WordPress Appointment Dark theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability
Published Nov 11, 2026
·Updated
Cross-Site Request Forgery (CSRF) vulnerability in webriti Appointment Dark appointment-dark allows Cross Site Request Forgery.This issue affects Appointment Dark: from n/a through 1.3.4.
Event History
Nov 11, 2026
CVE Published
via MITRE·01:16 PM
Data Sourced
via MITRE·01:16 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What must an attacker do to exploit this issue?
The attacker must induce a user to interact with a malicious request, as indicated by the UI:R vector. No attacker privileges are required, and the attack can be delivered over the network.
2
Which installations may be affected?
Appointment Dark versions through 1.3.4 are affected. The available data does not identify any configuration prerequisite or confirm whether all default deployments are vulnerable.
3
What is the potential impact if exploitation succeeds?
The vulnerability is rated high severity with a CVSS score of 8.8. The supplied vector indicates potential high impact to confidentiality, integrity, and availability.