WordPress security by component
Werkstatt
Theme description
Werkstatt is a WordPress component with 4 published CVE records in this archive. The latest tracked vulnerability was published Jul 02, 2026; the highest CVE/CNA score is 8.8.
Theme slug:
werkstattLatest vulnerability
CVE-2026-57690: Werkstatt: Cross-site request forgery
Werkstatt is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The published affected range is n/a through 4.7.2.
| Safe version |
|
||
|---|---|---|---|
| Jul 02, 2026 |
CVE-2026-57690
Werkstatt: Cross-site request forgery
Werkstatt is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request. The published affected range is n/a through 4.7.2.
|
> 4.7.2 |
CVE4.3
NVDPending
|
| Jul 02, 2026 |
CVE-2026-57689
Werkstatt: A security weakness
Werkstatt is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 4.7.2.
|
> 4.7.2 |
CVE4.3
NVDPending
|
| Jul 02, 2026 |
CVE-2026-27414
Werkstatt: Code execution
Werkstatt is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is n/a through 4.8.3.
|
> 4.8.3 |
CVE8.8
NVDPending
|
| Jan 22, 2026 |
CVE-2025-69314
Werkstatt: Filesystem traversal
Werkstatt is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE8.1
NVDPending
|