EUVD-2026-41299
GHSA-c6wx-4wg3-cr9h
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-reachable CSRF requiring no attacker privileges but mandatory victim interaction; integrity-only impact with no confidentiality or availability effect matches the CWE-352 pattern.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Request Forgery (CSRF) in Werkstatt <= 4.7.2 versions.
AnalysisAI
Cross-Site Request Forgery in the Werkstatt WordPress theme (FuelThemes) version 4.7.2 and earlier allows remote unauthenticated attackers to perform unauthorized state-changing actions on behalf of authenticated WordPress users. The flaw stems from missing or inadequate CSRF token validation on one or more theme action endpoints, meaning a crafted web page or link can silently trigger privileged operations when visited by a logged-in user. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Technical ContextAI
The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), a well-understood web security weakness where an application fails to verify that a state-changing HTTP request originates from the legitimate user session rather than a third-party site. In WordPress, the standard mitigation is the WordPress nonce system (wp_nonce_field / check_admin_referer), which ties requests to a time-limited, user-session-bound token. The Werkstatt theme, identified by CPE cpe:2.3:a:fuelthemes:werkstatt:*:*:*:*:*:*:*:*, omits this protection in at least one request handler, exposing its administrative or user-facing actions to forged browser requests. The wildcard CPE version field indicates all releases up to and including 4.7.2 are affected.
RemediationAI
Update the Werkstatt theme to a version later than 4.7.2 as reported by Patchstack. Consult the advisory at https://patchstack.com/database/wordpress/theme/werkstatt/vulnerability/wordpress-werkstatt-theme-4-7-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve for the specific patched release version, which was not independently confirmed from the input data provided. If an immediate update is not feasible, a compensating control is to enforce strict same-site cookie policies (SameSite=Strict or Lax) at the server or CDN layer, which will block cross-origin forged requests for most modern browsers - note this does not fix the underlying missing nonce check and may have side effects on legitimate cross-site navigation flows. Additionally, restricting access to the WordPress admin dashboard by IP allowlist reduces the attack surface, as CSRF typically targets actions requiring an authenticated admin session. No patch version number was provided in the input data; do not apply a specific version without first verifying it against the Patchstack advisory.
PHP Object Injection in the Werkstatt WordPress theme (fuelthemes) through version 4.8.3 lets a Contributor-level user p
Broken access control in the Werkstatt WordPress theme (Fuelthemes) versions 4.7.2 and below allows subscriber-level aut
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today