Webriti Wallstreet EUVD-2026-91774

Exploitation requires a victim who is authenticated to the WordPress site (realistically an administrator) and who is tricked into visiting attacker-controlled content or clicking a malicious link while that session is active - this user-interaction requirement (UI:R) is the primary limiting factor. The underlying prerequisite is that the Wallstreet theme (versions n/a through 2.8.6) performs a state-changing operation without validating an anti-CSRF nonce. The attacker needs no credentials or prior access, but cannot succeed against an administrator who is not logged in or who does not interact with the forged request; sites running a patched version above 2.8.6 (version unspecified in input) are not affected.

This is a CWE-352 Cross-Site Request Forgery in the Webriti 'Wallstreet' WordPress theme (versions up to and including 2.8.6), reported by Patchstack with an assigned CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The vector indicates a network-reachable, low-complexity attack needing no attacker privileges but requiring user interaction (UI:R) - characteristic of CSRF, where the request is forged but must be triggered by a logged-in victim (typically an authenticated administrator) visiting an attacker-controlled page. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The headline 8.8 score is driven by the triple-High C/I/A impact Patchstack assigns, but CSRF realistically yields only the state-changing action the forged request performs and is gated by the UI:R requirement and by the victim needing an active authenticated session - so the practical priority is lower than the 8.8 suggests. Note the tension: PR:N labels the attack 'unauthenticated' (true for the attacker), yet successful exploitation depends entirely on an authenticated administrator being tricked into triggering the request - verify the actual sensitivity of the affected action with the Patchstack advisory before treating this as critical.

An attacker crafts a malicious web page or email containing a forged request targeting a privileged Wallstreet theme action and lures a logged-in WordPress administrator into visiting it. Because the theme does not validate a CSRF nonce, the victim's browser submits the state-changing request using their active session. No public proof-of-concept was provided, and exploitation requires the victim to be authenticated and to interact with the attacker's content (UI:R).