CVE Intelligence
Analysis AI-assisted

CVE-2026-39617: Bluestreet WordPress Theme CSRF Vulnerability (up to 1.7.3)

CVE-2026-39617 is a Cross-Site Request Forgery (CSRF) weakness in the Bluestreet theme by priyanshumittal, classified as CWE-352. The record lists the affected range as up to and including 1.7.3 and gives a CVSS 3.1 base score of 9.6 (critical). No confirmed exploitation in the wild appears in the sources consulted, and the record marks the CVE as not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a Cross-Site Request Forgery (CSRF) weakness in the Bluestreet theme published by priyanshumittal, indexed under CWE-352. The only reference in the record points to a Patchstack database entry for a Bluestreet WordPress theme, and the address of that entry suggests the issue may allow arbitrary plugin installation.

Impact

CSRF weaknesses allow a request to be sent on behalf of an authenticated user without that user intending the action. The CVSS 3.1 vector recorded for this CVE rates confidentiality, integrity and availability impact as high, with a changed scope and required user interaction. Real-world consequences depend on which actions the affected site lets an authenticated user perform.

Affected products and versions

  • Product: Bluestreet theme by priyanshumittal, described in the reference as a WordPress theme.
  • Affected range stated in the record: from n/a through 1.7.3 inclusive.
  • The lower bound is not provided (n/a). No fixed version appears in the record.

Exploitation status

The record shows the CVE is not listed in CISA KEV. No confirmed exploitation in the wild appears in the sources consulted for this analysis. The EPSS probability is 0.00201 with a percentile of 0.09218, dated 2026-10-13 as recorded.

Remediation and mitigation

  • Check whether the Bluestreet theme is installed on your WordPress sites and which version is active.
  • Treat versions up to and including 1.7.3 as in scope. Consult the vendor or the Patchstack entry for an updated release; the record does not name one.
  • Until a fixed release is confirmed, reduce exposure: limit administrative sessions to trusted browsers, log out of administrative accounts when not in use, and restrict who can reach the administration area.
  • Keep WordPress core and other plugins current, and review recently added themes and plugins for anything unexpected.

Detection guidance

  • Review administrative logs for plugin or theme installations and setting changes that administrators did not initiate.
  • Look for unexpected new plugins, altered configuration or newly created administrator accounts.
  • Monitor web server logs for state-changing requests to administrative endpoints that lack the expected referrer or come from unfamiliar sources.

Limitations of the available information

The record contains no lower bound for the affected range, no fixed version, no vendor advisory text beyond the description, and no technical details of the flaw. The English title is missing. The CVSS score is reported by two providers with the same value. The EPSS date is later than the publication date and should be verified against the current feed.

Frequently asked questions

Which Bluestreet versions does CVE-2026-39617 cover?

The record lists the affected range as from n/a through 1.7.3 inclusive. The lower bound is not given, and no fixed version is listed in the record.

Is this CVE being actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted for this analysis.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.