What is the CVSS score of CVE-2026-57785?

CVE-2026-57785 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Apuslisting are affected by CVE-2026-57785?

ApusListing WordPress theme versions 1.2.63 and earlier contain a critical CSRF vulnerability that enables unauthenticated attackers to hijack authenticated user sessions and compromise accounts.

How to fix or mitigate CVE-2026-57785?

Within 24 hours, inventory all WordPress installations using ApusListing versions 1.2.63 or earlier; restrict administrative access and disable the theme if not actively required in production. Over the next 7 days, deploy Web Application Firewall rules to block CSRF attack patterns, review authentication and access logs for exploitation indicators, and enforce anti-CSRF tokens and SameSite cookie policies on affected systems. Within 30 days, monitor Patchstack and WordPress.org for vendor patches; establish expedited deployment procedures for immediate application upon release, or evaluate and migrate to alternative maintained themes if no patch becomes available.

Apuslisting CVE-2026-57785

EUVD-2026-48182 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-23 Patchstack

GHSA-2qrw-v6m9-cjjq

CSRF Apuslisting

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:24 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 8.8

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in ApusListing <= 1.2.63 versions.

AnalysisAI

Cross-Site Request Forgery in the ApusListing WordPress theme (versions 1.2.63 and earlier) lets a remote, unauthenticated attacker forge privileged state-changing requests that a logged-in victim's browser executes, chaining into a broken-authentication condition that can lead to account or session compromise. Reported by Patchstack and rated CVSS 8.8, exploitation requires tricking an authenticated user into visiting attacker-controlled content (UI:R). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.