Wordpress Theme
CVE-2026-28036
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Server-Side Request Forgery (SSRF) vulnerability in SkatDesign Ratatouille ratatouille allows Server Side Request Forgery.This issue affects Ratatouille: from n/a through <= 1.2.6.
AnalysisAI
SkatDesign Ratatouille versions up to 1.2.6 contain a server-side request forgery vulnerability that allows authenticated attackers to make arbitrary HTTP requests from the affected system. An attacker with valid credentials can leverage this flaw to access internal services, retrieve sensitive information, or perform actions on behalf of the server across different security domains. No patch is currently available for this medium-severity vulnerability.
Technical ContextAI
Classified as CWE-918 (Server-Side Request Forgery (SSRF)). Affects SkatDesign Ratatouille ratatouille. Server-Side Request Forgery (SSRF) vulnerability in SkatDesign Ratatouille ratatouille allows Server Side Request Forgery.This issue affects Ratatouille: from n/a through <= 1.2.6.
Affected ProductsAI
Product: SkatDesign Ratatouille ratatouille.
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
More in Wordpress Theme
View allThe Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the news
The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and in
A vulnerability in posimyththemes Nexter nexter.0.3. Rated high severity (CVSS 8.5), this vulnerability is remotely expl
The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Acti
Remote code execution in the dmcwebzone Airin Blog WordPress plugin (versions up to and including 1.6.1) is possible thr
search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS. Rated medium severity (CVSS 6.1), thi
Unrestricted Upload of File with Dangerous Type vulnerability in EPC AI Hub allows Upload a Web Shell to a Web Server.3.
Backdoor / malicious code implant in the Silk Themes 'Newspapers X' WordPress theme (versions 1.0.46 through 1.0.48) all
Critical unrestricted file upload vulnerability in NasaTheme Flozen that allows unauthenticated remote attackers to uplo
Remote code execution in LogisticsHub WordPress theme allows unauthenticated attackers to upload arbitrary files, includ
Farost Energia WordPress plugin allows unrestricted file upload enabling attackers to upload web shells and achieve remo
Unrestricted file upload in the Medcity WordPress theme before version 1.1.9 allows unauthenticated attackers to upload
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today