What is the CVSS score of CVE-2026-57786?

CVE-2026-57786 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WorkScout Core are affected by CVE-2026-57786?

An authentication bypass vulnerability in WorkScout Core WordPress plugin (CVSS 8.8) allows attackers to trick authenticated users into authorizing unauthorized administrative actions when visiting…

How to fix or mitigate CVE-2026-57786?

Within 24 hours, audit all WordPress installations to identify systems running WorkScout Core plugin versions up to 1.7.08 and document deployment scope and criticality. Within 7 days, restrict the plugin's administrative capabilities through WordPress role and permission controls, and limit authenticated user access to WordPress admin interfaces via IP whitelisting or mandatory VPN to reduce exploitation surface. Within 30 days, establish continuous monitoring for patch announcements from Patchstack and WorkScout developers, and prepare a staged testing and deployment plan to apply updates within 48 hours of vendor release.

WorkScout Core CVE-2026-57786

EUVD-2026-43402 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-13 Patchstack

WordPress Authentication Bypass CSRF Wordpress Plugin Workscout Core Purethemes

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network CSRF with no attacker privileges but mandatory victim interaction (UI:R); auth bypass yields high confidentiality and integrity impact, but availability impact is not demonstrated (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:35 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 8.8

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core workscout-core allows Authentication Bypass.This issue affects WorkScout-Core: from n/a through <= 1.7.08.

AnalysisAI

Authentication bypass in the WorkScout Core WordPress plugin (versions up to and including 1.7.08) can be triggered through a Cross-Site Request Forgery flaw, letting an off-site attacker perform privileged authentication-related actions in the context of a logged-in victim who visits a malicious page. The issue was reported by Patchstack and carries a CVSS 8.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because exploitation hinges on tricking an authenticated user into clicking (UI:R), it is high-impact but not point-and-click automatable.

Technical ContextAI

WorkScout Core is the companion plugin for the WorkScout job-board theme (vendor purethemes) on WordPress, identified by CPE cpe:2.3:a:purethemes:workscout-core:*:*:*:*:*:*:*:*. The root cause is CWE-352 (Cross-Site Request Forgery): one or more state-changing, authentication-related endpoints lack a validated anti-CSRF nonce, so the application cannot distinguish a request the user intended to make from one forged by an attacker's page. When the affected action governs login/session or account state, a successful CSRF results in an authentication bypass - the attacker causes an authentication decision to be made on the server without legitimately supplying credentials.

RemediationAI

No vendor-released patch identified at time of analysis - the advisory only marks all builds through 1.7.08 as vulnerable and does not cite a fixed version, so administrators should monitor the WorkScout/purethemes changelog and the Patchstack entry (https://patchstack.com/database/Wordpress/Plugin/workscout-core/vulnerability/wordpress-workscout-core-plugin-1-7-08-cross-site-request-forgery-csrf-to-broken-authentication-vulnerability) and upgrade to the first release above 1.7.08 as soon as it ships. Until then, apply compensating controls: deploy a WAF or the Patchstack virtual patch to block forged cross-site requests to the plugin's authentication endpoints, enforce SameSite=Lax/Strict on session cookies to blunt cross-origin request forgery, and require administrators to log out of the WordPress admin session when browsing untrusted sites to remove the authenticated victim the attack depends on. Note trade-offs: strict SameSite settings can break legitimate cross-site integrations, and aggressive WAF rules may false-positive on valid AJAX actions, so test in staging before enforcing.