CVE Intelligence
Analysis AI-assisted

CVE-2026-39620: priyanshumittal Appointment: CSRF Enabling Web Shell Upload

CVE-2026-39620 is a cross-site request forgery (CWE-352) flaw in the Appointment product by priyanshumittal, which the record says can be used to upload a web shell to a web server. Patchstack, the CNA, rates it critical with a CVSS 3.1 base score of 9.6, and the record covers versions through 3.5.5. The record lists no affected or fixed versions and the CVE is not in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-39620 is a cross-site request forgery issue (CWE-352) in the Appointment product by priyanshumittal. The record describes it as allowing a web shell to be uploaded to a web server. The reference points to a Patchstack database entry for a WordPress theme named appointment, which is an inference from the URL path.

Impact

  • Patchstack rates the issue as critical, with a CVSS 3.1 base score of 9.6.
  • The vector in the record indicates network attack, low complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity and availability.
  • A successful web shell upload could let an attacker run commands on the server. This is an inference from the description and is not stated in the record.

Affected products and versions

  • Product: Appointment by priyanshumittal.
  • Range stated in the record: from n/a through 3.5.5, inclusive.
  • The record's affected and fixes lists are empty, so no fixed version is confirmed in the sources consulted.

Exploitation status

No confirmed exploitation appears in the sources consulted. The record shows the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The recorded EPSS probability is 0.00201 with a percentile of 0.0922.

Remediation and mitigation

  • Confirm whether the Appointment theme is installed and which version is in use.
  • Update to a release newer than 3.5.5 if the vendor has published one, and verify the fix in the vendor or Patchstack advisory, since the record names no fixed version.
  • If an update cannot be applied right away, limit access to administrative and upload functions and consider web application firewall rules that restrict cross-site requests to sensitive endpoints.
  • After patching, confirm that form submissions use anti-CSRF tokens.

Detection guidance

  • Review upload directories and theme folders for unexpected script files, recent modification times, or unusual file extensions.
  • Review web server logs for unexpected POST requests to theme-related endpoints, especially those arriving from external referrers.
  • Compare theme files with a known clean copy to find unauthorized changes.

Limitations of the available information

  • The record gives no affected or fixed version beyond the stated range through 3.5.5.
  • The record has no title and its source status is Deferred.
  • The description does not identify the vulnerable endpoint or the exact conditions required.
  • The EPSS date in the record is later than the publication date, so the score should be interpreted with caution.
  • The identification of a WordPress theme rests on the reference URL path only.

Frequently asked questions

Is CVE-2026-39620 being actively exploited?

The sources consulted show no confirmed exploitation, and the record shows the CVE is not listed in the CISA KEV catalog. Treat the issue seriously anyway because the CVSS score is critical.

Which versions are affected?

The record states a range from n/a through 3.5.5 inclusive. It does not list specific affected or fixed versions, so check the vendor or Patchstack advisory to confirm your installed version.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.