CVE Intelligence
Analysis AI-assisted

CVE-2026-39619: WordPress Busiprof theme CSRF to arbitrary file upload

CVE-2026-39619 is a Cross-Site Request Forgery weakness in the Busiprof WordPress theme by priyanshumittal, affecting versions up to and including 2.5.2. According to the record, the flaw can be leveraged to upload a web shell to the web server, and Patchstack rates it critical with a CVSS 3.1 score of 9.6. The record lists no fixed version and no confirmed exploitation in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-39619 affects the Busiprof theme for WordPress, published by priyanshumittal. The record describes a Cross-Site Request Forgery weakness that can be abused to upload a web shell to the web server. The CNA Patchstack scored it 9.6 (critical) under CVSS 3.1. Details are available in the Patchstack entry and the NVD record.

Impact

The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, meaning network reachable, low complexity, no privileges required, user interaction required, scope changed, and high impact to confidentiality, integrity and availability. The record's description points to arbitrary file upload as the outcome.

  • A web shell on a server would generally allow an attacker to run commands as the web server user (inference from the description, not stated in the record).
  • Data stored by the site, its administrators and its visitors could be exposed or altered (inference from the CVSS vector).
  • Site availability could be affected (inference from the availability impact in the vector).

Affected products and versions

  • Priyanshumittal Busiprof, WordPress theme, versions from n/a through 2.5.2 (the record lists the upper bound as less than or equal to 2.5.2 and does not state a lower bound).

Exploitation status

  • The CVE is not listed in CISA KEV in the record.
  • The record's SSVC data marks exploitation as none and automatable as no.
  • No confirmed active exploitation appears in the sources consulted.
  • The EPSS probability is reported as 0.00201 with a percentile of 0.09218.

Remediation and mitigation

  • The record lists no fixed version. Check the vendor and the Patchstack entry for an update released after 2.5.2 and apply it as soon as it is available.
  • If no fixed version is confirmed, consider deactivating or removing the theme on sites where it is not essential, and plan a replacement.
  • Limit administrator sessions: log out after administrative work and avoid browsing untrusted sites while logged in to the WordPress dashboard.
  • Restrict which file types the web server and WordPress accept in upload locations, and review write permissions on directories that do not need them.
  • Consider temporary protection from a web application firewall, based on vendor or provider guidance, until a fix is applied.

Detection guidance

  • Review web server and WordPress logs for unexpected state-changing requests to theme or administrative endpoints, especially those with external referrers.
  • Look for newly created or modified script files in upload folders, theme directories and other writable paths.
  • Use file integrity monitoring or scheduled comparison against a known-good copy of the WordPress installation.
  • Investigate any unfamiliar files or outbound connections originating from the web server.

Limitations of the available information

  • The record gives no fixed version, no vendor advisory text, and no lower bound for the affected range.
  • The record does not describe the vulnerable endpoint or the exact conditions required for exploitation.
  • The EPSS date in the record is not used to draw conclusions here.
  • The information above is based only on the record and the cited pages.

Frequently asked questions

Which versions of the Busiprof theme are affected by CVE-2026-39619?

The record lists Busiprof by priyanshumittal from n/a through 2.5.2 inclusive. It does not state a lower bound for the range.

Is CVE-2026-39619 known to be exploited in the wild?

The record shows the CVE is not listed in CISA KEV and marks SSVC exploitation as none. No confirmed active exploitation appears in the sources consulted.

What should site owners do now?

Check for an update beyond 2.5.2 from the vendor or Patchstack, apply it when available, and if no fix is confirmed, consider deactivating the theme. Review logs and upload directories for unexpected files in the meantime.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.