What is the CVSS score of CVE-2026-39619?

CVE-2026-39619 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Busiprof are affected by CVE-2026-39619?

The Busiprof WordPress theme (versions ≤2.5.2) contains a critical CSRF vulnerability that allows unauthenticated attackers to manipulate authenticated administrators into uploading malicious files,…

How to fix or mitigate CVE-2026-39619?

Within 24 hours: Identify all WordPress installations using Busiprof theme ≤2.5.2 via admin dashboard or theme audit tools; disable the theme immediately if not actively required. Within 7 days: Deactivate and remove the vulnerable Busiprof theme entirely; implement a supported alternative theme with active security maintenance. Within 30 days: Conduct server-side file integrity audit to detect any unauthorized uploads; review admin audit logs for suspicious CSRF activity; implement CSRF token validation at the application layer as a compensating control if theme cannot be immediately removed.

Busiprof CVE-2026-39619

EUVD-2026-20261 CRITICAL

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-08 Patchstack

GHSA-7gr5-hfgj-rpgg

CSRF Busiprof

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20261

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

CRITICAL 9.6

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Busiprof busiprof allows Upload a Web Shell to a Web Server.This issue affects Busiprof: from n/a through <= 2.5.2.

AnalysisAI

Cross-Site Request Forgery (CSRF) in Busiprof WordPress theme versions ≤2.5.2 enables unauthenticated attackers to upload web shells to the server by tricking authenticated administrators into executing malicious requests. Successful exploitation grants remote code execution capabilities through arbitrary file upload, allowing complete server compromise. CVSS 9.6 reflects cross-site scope with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, with low observed exploitation activity (EPSS 0.01%).

Technical ContextAI

CSRF vulnerability (CWE-352) bypasses file upload restrictions by exploiting missing anti-CSRF token validation in upload functionality. Unauthenticated attack vector (PR:N) requires user interaction (UI:R) where privileged user must trigger forged request, enabling arbitrary PHP web shell placement. Cross-site scope (S:C) indicates resource compromise beyond vulnerable component boundaries, escalating from CSRF to remote code execution.

RemediationAI

No vendor-released patch identified at time of analysis for versions beyond 2.5.2. Immediately deactivate and replace Busiprof theme with actively maintained alternative. If theme must remain operational, implement Web Application Firewall (WAF) rules blocking unauthorized file uploads, restrict administrative access to trusted IP addresses, and enforce Content Security Policy (CSP) headers to mitigate CSRF vectors. Monitor server for suspicious PHP files in upload directories (/wp-content/uploads, /wp-content/themes/busiprof). Review Patchstack advisory for technical details: https://patchstack.com/database/Wordpress/Theme/busiprof/vulnerability/wordpress-busiprof-theme-2-5-2-cross-site-request-forgery-csrf-to-arbitrary-file-upload-vulnerability