VulnSocial

CVE-2026-6812Disclosure

LOWCVSS 4.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The Ona theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.26 via the ona_activate_child_theme. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 2 classified signals
  • Peaked 1d ago at 3 mentions (2026-05-02); latest day: 1
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-05-02: 3Mentions · 2026-07-22: 1Technical Details · 2026-05-02: 305-0207-22
Signal classification2 categories
Disclosure
250.0%
General
250.0%
Referenced assets20 URLs
By indicator
Classification over time
DateTotalLabels
2026-05-023
Disclosure2General1
2026-07-221
General1
Full discourse4 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-6812 The Ona theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.26 via the ona_activate_child_theme. This makes it poss… https://www.cve.org/CVERecord?id=CVE-2026-6812

    Post summary

    The post discloses that the Ona WordPress theme versions up to 1.26 are vulnerable to SSRF via the ona_activate_child_theme function, with no evidence of an active exploit, PoC, patch, or false‑positive statement.

    00010265
    57.4K followersView on X
  • Jan Guldentops@JanGuldentops
    General

    Alle individuele kwetsbaarheden uit de post met hun rechtstreekse link naar de European Vulnerability Database (EUVD) van ENISA: Active Directory Federation Services privilege escalation (CVE-2026-56155): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-56155 BitLocker encryptieomzeiling (CVE-2026-50661): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-50661 Remote Desktop kwetsbaarheid (CVE-2026-56190): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-56190 Hyper-V virtual machine escape (CVE-2026-57092): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-57092 Cisco VoIP kwetsbaarheid (CVE-2026-20150): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-20150 Cisco SD-WAN kwetsbaarheid (CVE-2026-20182): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-20182 Google Chrome bug 1 (CVE-2026-6811): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-6811 Google Chrome bug 2 (CVE-2026-6812): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-6812 Google Chrome bug 3 (CVE-2026-6813): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-6813 Curl kwetsbaarheden range (CVE-2026-22834 t/m CVE-2026-22851): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-22834 Fortinet FortiSandbox securitylek 1 (CVE-2026-25089): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-25089 Fortinet FortiSandbox securitylek 2 (CVE-2026-39808): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-39808 SonicWall SMA1000 server-side request forgery (CVE-2026-15409): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-15409 SonicWall SMA1000 code injection en privesc (CVE-2026-15410): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-15410 WordPress zero day (CVE-2026-63030): https://euvd.enisa.europa.eu/vulnerability/CVE-2026-63030 Linux Kernel ip6_tunnel RCE ( CVE-2026-43037) https://euvd.enisa.europa.eu/vulnerability/CVE-2026-43037 • • Linux kernel XFRM IPSEc ESP bug ( CVE-2026-43284 ) https://euvd.enisa.europa.eu/vulnerability/CVE-2026-43285

    Post summary

    The post merely enumerates a list of CVEs with direct links to ENISA’s EUVD, without providing any PoC, exploitation details, patches, or technical information.

    00000171
    1.9K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-6812 The Ona theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.26 via the ona_activate_child_theme. This makes it poss… https://www.cve.org/CVERecord?id=CVE-2026-6812 ----- Traducción: CVE-2026-6812 El … http://infoflow.cloud`

    Post summary

    The tweet announces CVE-2026-6812, a Server-Side Request Forgery flaw in the Ona WordPress theme (up to v1.26), without providing exploitation details, PoC, or patch information.

    0000032
    75 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-6812 Server-Side Request Forgery in Ona WordPress Theme Versions Up To 1.26 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6812

    Post summary

    CVE-2026-6812 is identified as a Server‑Side Request Forgery affecting Ona WordPress Theme up to version 1.26, with no PoC, exploit, patch, or active exploitation information provided.

    0000051
    4.0K followersView on X

Explore more

Back to dashboard