CVE-2026-22382— WordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme <= 1.3 - Cross Site Request Forgery (CSRF) vulnerability
Quick assessment
Affected
Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress plugin PawFriends - Pet Shop and Veterinary WordPress Theme 1.3及之前版本存在跨站请求伪造漏洞，该漏洞源于容易受到跨站请求伪造攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-22382
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme <= 1.3 - Cross Site Request Forgery (CSRF) vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Cross-Site Request Forgery (CSRF) vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Cross Site Request Forgery.This issue affects PawFriends - Pet Shop and Veterinary WordPress Theme: from n/a through <= 1.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress plugin PawFriends - Pet Shop and Veterinary WordPress Theme 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress plugin PawFriends - Pet Shop and Veterinary WordPress Theme 1.3及之前版本存在跨站请求伪造漏洞，该漏洞源于容易受到跨站请求伪造攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Mikado-Themes | PawFriends - Pet Shop and Veterinary WordPress Theme | 0 ~ 1.3 | - |
|
II. Public POCs for CVE-2026-22382
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-22382
请登录查看更多情报信息。
Same Patch Batch · Mikado-Themes · 2026-01-22 · 16 CVEs total
| CVE-2025-67938 | 8.1 HIGH | WordPress Biagiotti theme < 3.5.2 - Local File Inclusion vulnerability |
| CVE-2025-67940 | 8.1 HIGH | WordPress Powerlift theme < 3.2.1 - Local File Inclusion vulnerability |
| CVE-2025-54003 | 8.1 HIGH | WordPress Depot theme <= 1.16 - Local File Inclusion vulnerability |
| CVE-2026-22391 | 5.4 MEDIUM | WordPress Cocco theme <= 1.5.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22430 | 5.4 MEDIUM | WordPress Verdure theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22406 | 5.4 MEDIUM | WordPress Overton theme <= 1.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22400 | 5.4 MEDIUM | WordPress Holmes theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22404 | 5.4 MEDIUM | WordPress Innovio theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22409 | 5.4 MEDIUM | WordPress Justicia theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22396 | 5.4 MEDIUM | WordPress Fiorello theme <= 1.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22407 | 5.4 MEDIUM | WordPress Roam theme <= 2.1.1 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22398 | 5.4 MEDIUM | WordPress Fleur theme <= 2.0 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22411 | 5.4 MEDIUM | WordPress Dolcino theme <= 1.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22393 | 5.4 MEDIUM | WordPress Curly theme <= 3.3 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-22458 | 4.3 MEDIUM | WordPress Wanderland theme <= 1.5 - Broken Access Control vulnerability |
IV. Related Vulnerabilities
Same vendor: Mikado-Themes
-
CVE-2026-66657
WordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclus -
CVE-2026-66656
WordPress Foton Core plugin <= 1.1.1 - Local File Inclusion -
CVE-2026-57792
WordPress Dør theme <= 2.4.1 - Local File Inclusion vulnerab -
CVE-2026-52707
WordPress Kastell theme <= 2.0 - Local File Inclusion vulner -
CVE-2026-40756
WordPress Zoya theme <= 1.4 - PHP Object Injection vulnerabi
Same weakness: CWE-352
-
CVE-2026-102778
Joomla Extension - svenbluege.de - Cross-site scripting and -
CVE-2026-102776
Joomla Extension - svenbluege.de - Cross-site request forger -
CVE-2026-104407
WordPress PowerPress Podcasting plugin <= 11.17.9 - Cross Si -
CVE-2026-105292
Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callba -
CVE-2026-39718
WordPress Wallstreet theme <= 2.8.6 - Cross Site Request For
V. Comments for CVE-2026-22382
No comments yet