EUVD-2026-20257
GHSA-8j59-3fgc-7r5h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious webpage
-
ExploitTricks authenticated user into visiting site
-
ExecutionForged request executes with victim's session
-
ImpactUnauthorized action performed in Bluestreet
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Victim must be logged into Bluestreet <= 1.7.3 and click an attacker-crafted link or visit a malicious webpage. Attacker performs CSRF to execute unauthorized actions with victim's privileges. Remote, no authentication required for attacker. |
| Impact | CVSS 9.6 reflects unauthenticated network CSRF enabling arbitrary plugin installation with site-wide impact. However, EPSS 0.01% indicates low observed exploitation activity. Real risk depends on WordPress theme adoption and user click-through rates on malicious links. Prioritize patching only if Bluestreet is actively deployed in your environment. |
| Exploit ScenarioDerived | Attacker crafts malicious link/form redirecting authenticated WordPress admin to install arbitrary plugin via CSRF. Admin clicks link while logged in; plugin installs without consent. No public exploit code identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Cross-Site Request Forgery in priyanshumittal Bluestreet WordPress theme through version 1.7.3 enables unauthenticated attackers to perform arbitrary plugin installations via CSRF. Exploitation requires user interaction (victim must click malicious link or visit attacker-controlled page while authenticated to WordPress). High severity due to scope change and potential for complete site compromise through malicious plugin deployment. No public exploit identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis. Primary mitigation: immediately deactivate and remove Bluestreet theme from all WordPress installations. Replace with actively maintained alternative theme from WordPress.org repository. If theme must remain active, implement Web Application Firewall rules to block POST requests to plugin installation endpoints from external referrers, and restrict wp-admin access via IP allowlisting. Monitor for unauthorized plugin installations through WordPress audit logs. Full technical details and affected version confirmation available at Patchstack advisory: https://patchstack.com/database/Wordpress/Theme/bluestreet/vulnerability/wordpress-bluestreet-theme-1-7-3-cross-site-request-forgery-csrf-to-arbitrary-plugin-installation-vulnerability. Exploitation status: low observed exploitation activity (EPSS <1%).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CSRF vulnerability (CWE-352) stems from missing or inadequate anti-CSRF token validation in plugin installation functionality. CVSS vector PR:N indicates unauthenticated attack surface; S:C (scope change) reflects potential escalation beyond theme boundaries. Attacker crafts malicious request triggering plugin installation with administrator privileges, bypassing WordPress nonce protection mechanisms within theme code.
Know when Bluestreet gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Bluestreet bluestreet allows Cross Site Request Forgery.This issue affects Bluestreet: from n/a through <= 1.7.3.
Executive ViewAI
The Bluestreet WordPress theme (version 1.7.3 and earlier) contains a critical CSRF vulnerability that allows unauthenticated attackers to trick authenticated administrators into installing arbitrary plugins, potentially leading to complete site compromise. Organizations using this theme face immediate risk of malware injection and unauthorized site takeover if administrators visit attacker-controlled content while logged into WordPress. Urgent action is required to isolate affected sites until a vendor patch is available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable and replace the vulnerable Bluestreet theme immediately; (2) Restrict WordPress admin panel access by IP address and implement require-login enforcement; (3) Enforce security headers (SameSite cookies, X-Frame-Options) at web server level; (4) Deploy Web Application Firewall rules to detect and block CSRF patterns; (5) Require multi-factor authentication for all administrator accounts; (6) Implement plugin installation approval workflows requiring secondary authorization.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Exploit-DB