What is the CVSS score of CVE-2026-39621?

CVE-2026-39621 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Spicepress are affected by CVE-2026-39621?

CVE-2026-39621 is a critical CSRF vulnerability in SpicePress WordPress theme (versions ≤2.3.2.5) that allows unauthenticated attackers to trick authenticated administrators into installing malicious…

How to fix or mitigate CVE-2026-39621?

Within 24 hours: inventory all WordPress installations using SpicePress theme and identify current versions; disable the theme on all affected sites or restrict administrator access pending remediation. Within 7 days: upgrade SpicePress to version >2.3.2.5 if available from vendor, or implement the compensating controls listed below if upgrade is unavailable. Within 30 days: complete migration to an alternative WordPress theme, conduct security awareness training on CSRF attack mechanics for all administrative users, and perform malware scanning on all affected WordPress instances.

Spicepress CVE-2026-39621

EUVD-2026-20263 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-04-08 Patchstack

GHSA-pgqw-m834-qpv3

CSRF Spicepress

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20263

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

HIGH 8.8

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in spicethemes SpicePress spicepress allows Upload a Web Shell to a Web Server.This issue affects SpicePress: from n/a through <= 2.3.2.5.

AnalysisAI

CSRF vulnerability in SpicePress WordPress theme versions ≤2.3.2.5 enables unauthenticated attackers to upload web shells via arbitrary plugin installation, achieving remote code execution. Successful exploitation requires user interaction (victim must click malicious link while authenticated). No public exploit identified at time of analysis. CVSS 8.8 score reflects network-accessible, low-complexity attack with high impact to confidentiality, integrity, and availability.

Technical ContextAI

CWE-352 CSRF flaw permits state-changing operations without request verification tokens. Attack chain leverages missing anti-CSRF protections in theme's plugin installation mechanism, allowing HTTP request forgery to install malicious plugins containing web shells. cpe:2.3:a:spicethemes:spicepress references WordPress theme component vulnerable through upload functionality.

RemediationAI

No vendor-released patch identified at time of analysis for SpicePress 2.3.2.5. Recommended immediate actions: (1) Deactivate SpicePress theme and migrate to actively maintained alternative WordPress theme; (2) Audit installed plugins for unauthorized additions; (3) Implement Web Application Firewall rules blocking unauthorized plugin uploads; (4) Monitor Patchstack advisory for vendor update: https://patchstack.com/database/Wordpress/Theme/spicepress/vulnerability/wordpress-spicepress-theme-2-3-2-5-csrf-to-arbitrary-plugin-installation-vulnerability?_s_id=cve. Workaround: Restrict WordPress admin access to trusted IP ranges via .htaccess or firewall ACLs. EPSS 0.01% indicates low observed exploitation activity.