webriti Heroic theme: CSRF on theme options (CVE-2026-125841)

The affected Heroic theme exposes authenticated WordPress actions to cross-site request forgery. Remediate the theme to prevent actions initiated outside the user’s intended workflow.

Public CVE record · Source and API bundle

cve.now entry. Product: webriti Heroic WordPress theme (lab: gabriel-webriti-heroic-app).

Eden terminates the HTTP connection to the affected product, evaluates a declarative policy and — in tier 2 — a separately compiled native Rust module under signed module authority, before any byte reaches the application. It does not patch the affected component; the vendor's fixed release remains the durable repair.

Status: Remediated at the boundary, browser-scoped (tier 1 + tier 2), live-proven 2026-11-11T17:03:29Z on the installed eden-product-release:1.103.0 lab container.

The vulnerability

The Heroic theme persists options on a nonce-free admin action (admin-post.php?action=heroic_options), so a forged cross-site POST can persist attacker-chosen settings under an admin session. The fixture (_csrf("webriti4"), port 18323) reproduces the delivery shape: an options save without an Origin header records a forged-save mark; the same save with a site Origin passes without effect.

The Eden patch

Tier 1 — declarative policy (blunt, fail-closed): deny every request under /wp-admin/admin-post.php, every plugin/theme admin action included — false positives measured below.

Tier 2 — native Rust module gabriel_webriti4_v1 (surgical): refuses action=heroic_options saves that arrive without an Origin header; same-origin saves pass unchanged. Other admin actions are untouched.

Implement the remediation

The commands are operator examples for the recorded scope. Compare fixture routes and software selectors with the intended deployment before use. See deployment prerequisites.

1. Prepare the target. Verify the loaded product and version against the advisory. Use a compatible Eden HTTP interlay and an authenticated operator with Configure permission. Open the deployment example and API instructions. The bundle identifies module gabriel_webriti4_v1 version 1.0.0 and the SDK revision in patch.toml. Run the policy extraction from the adapter directory.
2. Apply the declarative policy. Scope the policy to /wp-admin/admin-post.php and descendants (all methods, deny). Set INTERLAY to the target interlay UUID in the authenticated Eden CLI. Run an authenticated GET /api/v1/interlays/{interlay} with X-Eden-Verbose: true. Save its complete current settings object as current-settings.json and retain the prior remediation declaration for recovery. Set IDEMPOTENCY_KEY to a fresh key for this intended mutation.

jq -e '.tier1' deployment.json > remediation.json
jq -e --slurpfile policy remediation.json \
  '.remediation = $policy[0] | {settings: .}' current-settings.json \
  > interlay-update.json
eden api request PATCH "/api/v1/interlays/$INTERLAY" \
  --header "Idempotency-Key:$IDEMPOTENCY_KEY" \
  --body-file interlay-update.json --content-type application/json --confirm

3. Verify the serving policy. Read back the interlay.

eden api request GET "/api/v1/interlays/$INTERLAY" \
  --header 'X-Eden-Verbose:true'

Check that remediation_status.state is ready and both desired and effective SHA-256 values match the intended declaration. Replay the benign and marked requests in the recorded comparison on an isolated target. Check the recorded response and backend outcome for each probe. Use the request and expected-status table in the linked API example alongside the observed comparison. 4. Restore the previous policy. Coordinate the change with any other operator updating this interlay. Read current settings again and merge the saved remediation field into them. If the prior settings had no remediation field, omit it in the replacement. Send the same PATCH with a fresh idempotency key, then read back the intended state. Repeat the verification probes. Keep the affected route isolated if restoring the prior settings reopens exposure.

Native module gabriel_webriti4_v1

1. Prepare the archive. Use the version 1.0.0 bundle for source, target, and build profile. Configure independent host approval for the installed Eden release. Use the authenticated principals required by the native authority contract. Set PATCH_ARCHIVE to the exact schema-2 package and PACKAGE_SHA256 to its expected archive digest. Verify and import it using the same target interlay.

printf '%s  %s\n' "$PACKAGE_SHA256" "$PATCH_ARCHIVE" | sha256sum --check &&
  eden api request PUT "/api/v1/interlays/$INTERLAY/patch-packages/$PACKAGE_SHA256" \
    --body-file "$PATCH_ARCHIVE" \
    --content-type application/vnd.eden.patch-package.v2+tar --confirm

2. Approve and activate. Enroll the publisher key, attest host software inventory, and inspect the configuration returned by import. Obtain independent host approval. Sign the typed statement with the matching SDK. Send the admit action followed by activate for the prepared operation. Use the applicable typed payload for each action in authority-action.json.

eden api request POST "/api/v1/interlays/$INTERLAY/native-authority" \
  --body-file authority-action.json --content-type application/json --confirm

3. Verify the operation. Read the receipt through the same endpoint. Confirm serving_now and the full expected shard acknowledgment. Repeat the report’s benign and marked probes and check the backend observations.
4. Revoke or restore. Send revoke with the exact operation UUID. Mandatory protection can refuse traffic until a compatible operation is approved and activated. Verify the restored receipt and repeat the probes.

Vendor update. Use the advisory to identify the supported update or workaround for the installed release. The advisory data used here supplies no fixed version. Confirm the running version and verify the affected feature after the change.

Measured comparison (fixtures10, run 2026-11-11)

Performance trace (Eden telemetry, live 2026-11-11)

Measured with Eden's built-in request telemetry (gateway.request.baseline spans, read back through /api/v1/analytics/telemetry?signal=traces), not client wall-clock. Latency Eden introduces per remediation arm for this case:

Eden-added latency for the tier-2 remediation: benign requests complete in 390 µs mean (p50 371 µs, p95 512 µs) in-product, module evaluation included. Honest scope: lab fixtures on one host, fresh connection per measured request, warm requests only; module reactivated shards 2/2 with a fresh signed statement per measurement; spans carry the full authority lineage (module SHA-256, operation, publication). Not the EDEN-3640 performance qualification contract.

Tested against: eden-product-release:1.103.0-single (image sha256:809293e1f0b525ac…, build target eden_service_single, tooling revision 81a0724a…). Raw data: module2/telemetry-ab/webriti4-telemetry.json and module2/tier1-ab/webriti4-tier1.json.

Authority lifecycle and negatives

Import 201, activation: explicit_required; publisher enroll_key, host inventory + approve, reader inspect refused 403; tampered-statement admit 400; invalid-signature admit 403; admit prepared (not serving), activate → receipt serving_now, applied shards 2/2. Revoke → the identical attack gets 503 (fail-closed); re-approve + re-activate → 403 again. All recorded in the evidence JSON.

Honest scope — partial, browser-scoped

Origin/Referer-presence enforcement stops forged browser requests (browsers set Origin on cross-site POSTs and forbid header forgery), but a non-browser client can set any Origin it likes. The rule is therefore a browser-scoped partial by construction — recorded as such, in the same honesty class as the withdrawn marker modules. A nonce at the theme would be the durable fix. Module binary SHA-256 2d356e80…, source modules/gabriel_webriti4_v1.rs.

Cost record

Run window 17:03:29Z → 17:03:38Z (per-CVE ledger, marginal session cost).

Evidence appendix

• Fixture: gabriel-2026-11-11/fixtures10.py (_csrf("webriti4"), port 18323)
• Evidence: gabriel-2026-11-11/module2/evidence/webriti4-module.json
• Module source: docs/case-studies/modules/gabriel_webriti4_v1.rs