What is the CVSS score of CVE-2026-61956?

CVE-2026-61956 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Woosalam Plugin are affected by CVE-2026-61956?

The Woosalam WooCommerce-to-Basalam synchronization plugin contains a CSRF vulnerability (CVSS 7.1) that allows attackers to manipulate e-commerce settings and data by tricking logged-in store…

How to fix or mitigate CVE-2026-61956?

Within 24 hours: Inventory all WordPress installations using Woosalam versions through 1.9.1 and identify active admin accounts. Within 7 days: Disable the Woosalam plugin if sync operations are not critical, or if continued use is necessary, implement Web Application Firewall (WAF) rules to block CSRF patterns targeting the plugin's sync endpoints and conduct admin security awareness training on phishing and malicious links. Within 30 days: Monitor vendor security advisories for Woosalam patched version release; upon availability, schedule immediate upgrade to the patched release; if no patch emerges within 60 days, escalate to replacement with an actively maintained alternative sync solution.

Woosalam Plugin CVE-2026-61956

EUVD-2026-43436 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-13 Patchstack

WordPress CSRF Wordpress Plugin 8211 Hamsalam

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network CSRF with low complexity and no attacker auth (PR:N) but mandatory victim interaction (UI:R); forged state changes give I:H, with no direct data read (C:N) or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:21 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in hamsalam ووسلام – همگام سازی ووکامرس و باسلام sync-basalam allows Cross Site Request Forgery.This issue affects ووسلام – همگام سازی ووکامرس و باسلام: from n/a through <= 1.9.1.

AnalysisAI

Cross-Site Request Forgery in the Woosalam (ووسلام - همگام سازی ووکامرس و باسلام) WooCommerce-to-Basalam sync plugin for WordPress lets a remote attacker forge state-changing requests that a logged-in victim's browser executes, affecting all versions from an unspecified initial release through 1.9.1. Because the plugin fails to validate request authenticity (CWE-352), an attacker who lures an authenticated user to a malicious page can trigger high-integrity changes with no attacker authentication required (CVSS 7.1). No public exploit identified at time of analysis and the flaw is not on CISA KEV.

Technical ContextAI

Woosalam is a third-party WordPress plugin (vendor 'hamsalam') that synchronizes a WooCommerce store with Basalam, an Iranian e-commerce marketplace, so product/order data flows between the two platforms. The vulnerability is a classic CWE-352 Cross-Site Request Forgery: one or more of the plugin's state-changing actions (typically admin-side handlers reached over admin-ajax.php or a settings form) do not enforce a WordPress nonce or equivalent anti-CSRF token, so the server cannot distinguish a legitimate first-party request from one silently generated by a third-party site. The single affected CPE is cpe:2.3:a:hamsalam:ووسلام_–_همگام_سازی_ووکامرس_و_باسلام:*, versions up to and including 1.9.1. This intelligence originates from a single source, Patchstack, which specializes in WordPress plugin vulnerabilities.

RemediationAI

No vendor-released patched version was identified at time of analysis - the advisory lists all versions through 1.9.1 as affected without naming a fixed release, so confirm availability of a version newer than 1.9.1 directly with the plugin author or via the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/sync-basalam/vulnerability/wordpress-oosl-m-hm-m-s-z-oo-mrs-o-b-sl-m-plugin-1-9-1-cross-site-request-forgery-csrf-vulnerability) before relying on an upgrade. Until a fixed version is confirmed, the strongest compensating control is to deactivate and remove the Woosalam plugin, which fully removes the exposure at the cost of losing WooCommerce-Basalam synchronization; if the sync must remain live, restrict wp-admin and admin-ajax.php access to trusted IPs or place them behind a VPN, and deploy a WordPress WAF/virtual-patch (Patchstack or equivalent) with CSRF protection to block forged state-changing requests. Additionally, instruct administrators not to browse untrusted sites while logged into WordPress, since the UI:R requirement means exploitation depends on an authenticated user's active session.