Wallstreet
Monthly
Cross-site request forgery in the Webriti 'Wallstreet' WordPress theme affects all versions through 2.8.6, letting an attacker forge state-changing requests that are executed with the privileges of a logged-in site administrator. The independent assessment rates this at CVSS 3.1 4.3-class impact (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) rather than the vendor-published 8.8, because exploitation depends on tricking an already-authenticated admin into visiting attacker-controlled content or clicking a crafted link while their session is active - the UI:R requirement is the primary limiting factor. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory (reported by Patchstack) indicates versions above 2.8.6 are not affected, though the input does not name that fixed version.
Cross-site request forgery in the Webriti 'Wallstreet' WordPress theme affects all versions through 2.8.6, letting an attacker forge state-changing requests that are executed with the privileges of a logged-in site administrator. The independent assessment rates this at CVSS 3.1 4.3-class impact (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) rather than the vendor-published 8.8, because exploitation depends on tricking an already-authenticated admin into visiting attacker-controlled content or clicking a crafted link while their session is active - the UI:R requirement is the primary limiting factor. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the advisory (reported by Patchstack) indicates versions above 2.8.6 are not affected, though the input does not name that fixed version.