CVE-2026-39620
Published: 08 April 2026
Summary
CVE-2026-39620 is a critical-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 3.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-39620 is a Cross-Site Request Forgery (CSRF) vulnerability, mapped to CWE-352, in the priyanshumittal Appointment WordPress theme. It affects all versions from an unspecified starting point through 3.5.5 and enables attackers to upload a web shell to the web server. The issue carries a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting its critical severity due to network accessibility, low complexity, no privileges required, user interaction dependency, and changed scope with high impacts across confidentiality, integrity, and availability.
Attackers can exploit this remotely without authentication by tricking a victim—likely an authenticated WordPress user such as an administrator—into interacting with a malicious site via a forged request. This user interaction triggers the CSRF, resulting in arbitrary file upload of a web shell. Successful exploitation allows attackers to achieve high-level compromise, including potential remote code execution on the server.
The primary advisory from Patchstack documents this as a CSRF-to-arbitrary-file-upload issue in Appointment theme version 3.5.5 and is available at https://patchstack.com/database/Wordpress/Theme/appointment/vulnerability/wordpress-appointment-theme-3-5-5-cross-site-request-forgery-csrf-to-arbitrary-file-upload-vulnerability?_s_id=cve. Practitioners should consult it for specific mitigation steps, such as applying patches or workarounds if available for affected versions.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20262
Vulnerability details
Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Appointment appointment allows Upload a Web Shell to a Web Server.This issue affects Appointment: from n/a through <= 3.5.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF vuln in public-facing WordPress theme directly enables exploitation of the application (T1190) to achieve arbitrary file upload of a web shell (T1100) for RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Remediating the specific CSRF-to-arbitrary-file-upload flaw in the Appointment WordPress theme prevents exploitation leading to web shell uploads.
Enforcing session authenticity directly counters CSRF attacks by requiring verification tokens or equivalent for state-changing operations like file uploads.
Validating inputs on file upload endpoints prevents malicious web shells from being accepted even if a CSRF request reaches the server.