What is the CVSS score of CVE-2026-59520?

CVE-2026-59520 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

CrawlWP SEO CVE-2026-59520

EUVD-2026-41784 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-05 Patchstack

GHSA-x7f9-wcv3-wvpj

WordPress CSRF Wordpress Plugin Crawlwp Seo Properfraction

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Matches provided vector: network-reachable, trivial complexity, no privileges needed, passive victim interaction mandatory, integrity-only low impact, no scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 05, 2026 - 22:18 vuln.today

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in properfraction CrawlWP SEO allows Cross Site Request Forgery.

This issue affects CrawlWP SEO: from n/a through 3.0.16.

AnalysisAI

Cross-Site Request Forgery in the CrawlWP SEO WordPress plugin (versions through 3.0.16) allows an unauthenticated attacker to perform unauthorized state-changing actions on behalf of an authenticated site administrator. Exploitation requires social engineering - a logged-in admin must be tricked into visiting a malicious page that silently submits a forged request. The integrity impact is low, limited to unauthorized configuration changes within the plugin's functionality. No public exploit code or active exploitation has been identified at time of analysis, consistent with the vulnerability's low CVSS base score of 4.3.

Technical ContextAI

CrawlWP SEO (WordPress plugin slug: mihdan-index-now, vendor: properfraction) is a WordPress SEO plugin implementing the IndexNow protocol to notify search engines of URL changes. The root cause is CWE-352 (Cross-Site Request Forgery): one or more of the plugin's administrative endpoints lack CSRF nonce verification, a standard WordPress security primitive (wp_verify_nonce). Absent this check, a crafted HTML form on an attacker-controlled page can submit authenticated requests to the target WordPress site using the victim's active browser session credentials. The affected CPE is cpe:2.3:a:properfraction:crawlwp_seo:*:*:*:*:*:*:*:*, covering all versions through 3.0.16. The Patchstack advisory references the plugin's legacy slug (mihdan-index-now), confirming the plugin underwent a renaming or vendor transfer.

RemediationAI

Update the CrawlWP SEO plugin to a version beyond 3.0.16 that includes CSRF nonce validation on affected administrative endpoints. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/mihdan-index-now/vulnerability/wordpress-index-now-plugin-3-0-16-cross-site-request-forgery-csrf-vulnerability?_s_id=cve should be consulted for the exact patched version - a specific fix version is not independently confirmed from available input data. If an immediate update is not possible, administrators should restrict access to the WordPress admin panel by IP allowlist, reducing the practical attack surface by limiting which sessions an attacker could target. Additionally, training administrators to avoid clicking unsolicited links while authenticated to WordPress reduces the social engineering exposure. Neither workaround fully mitigates the underlying flaw and patching remains the definitive remediation.