What is the CVSS score of CVE-2026-57766?

CVE-2026-57766 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of WPIDE are affected by CVE-2026-57766?

The WPIDE File Manager plugin for WordPress (versions 3.5.6 and earlier) is vulnerable to CSRF attacks that allow unauthenticated threat actors to trick administrators into making unauthorized file…

How to fix or mitigate CVE-2026-57766?

No vendor-released patch identified at time of analysis. Within 24 hours: Deactivate WPIDE plugin versions ≤3.5.6 immediately, or if operational need exists, restrict plugin access to specified IP addresses using firewall rules. Within 7 days: Establish monitoring of WPIDE's official changelog and WordPress.org plugin repository for patch availability; document current plugin version in your asset inventory. Within 30 days: If patch becomes available, deploy vendor-released patch (version >3.5.6), validate in staging environment, and restore plugin functionality; otherwise, evaluate and implement alternative file management solution.

WPIDE CVE-2026-57766

EUVD-2026-41321 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-02 Patchstack

GHSA-jq6p-fffc-h97g

WordPress CSRF Wordpress Plugin Wpide File Manager Code Editor Xplodedthemes

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network CSRF needs no attacker privileges (PR:N) but requires an admin to click (UI:R); forged file writes yield full C/I/A impact, so 8.8.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:20 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE - File Manager & Code Editor <= 3.5.6 versions.

AnalysisAI

Cross-Site Request Forgery in the WPIDE - File Manager & Code Editor WordPress plugin (versions <= 3.5.6) allows a remote attacker to forge privileged requests that a logged-in administrator's browser executes without consent. Because WPIDE exposes filesystem read/write and code-editing functionality, a successful CSRF can lead to arbitrary file modification and effectively remote code execution on the WordPress host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.

Technical ContextAI

The affected component is WPIDE (vendor xplodedthemes, CPE cpe:2.3:a:xplodedthemes:wpide_-_file_manager_&_code_editor), a WordPress plugin that provides an in-dashboard file manager and code editor allowing operators to read, edit, create, and delete files directly on the server. The root cause is CWE-352 (Cross-Site Request Forgery): state-changing plugin actions are not protected by a properly validated anti-CSRF nonce, so the server cannot distinguish a legitimate admin-initiated request from one forged by a malicious third-party page. Because the plugin's core function is writing to the filesystem (including PHP source), a forged write request is far more damaging than a typical settings-change CSRF, since attacker-controlled PHP can be planted and executed.

RemediationAI

No vendor-released patch version is identified in the available data; the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wpide/vulnerability/wordpress-wpide-file-manager-code-editor-plugin-3-5-6-cross-site-request-forgery-csrf-vulnerability) covers versions <= 3.5.6, so upgrade to any later release the vendor publishes above 3.5.6 once available and confirm it addresses CWE-352. Until a confirmed patched version exists, the highest-value compensating control is to deactivate and remove the WPIDE plugin, since its file-editing capability is the exact asset a CSRF weaponizes - the trade-off is loss of in-dashboard file management. If the plugin must remain, restrict wp-admin access by IP allowlisting or VPN so forged requests from arbitrary origins are less likely to reach an active admin session, require administrators to log out of WordPress when not actively working, and consider a WAF rule enforcing referer/origin checks on WPIDE endpoints, accepting that origin-based filtering can break legitimate workflows and is not a substitute for nonce validation.