What is the CVSS score of CVE-2026-65536?

CVE-2026-65536 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

WooCommerce Persian Shipping CVE-2026-65536

EUVD-2026-48137 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-23 Patchstack

GHSA-v38p-877j-q2pm

WordPress CSRF Wordpress Plugin

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

CSRF requires no attacker privileges (PR:N) but mandates victim interaction (UI:R); integrity-only impact with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:09 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.

AnalysisAI

Cross-Site Request Forgery (CSRF) in the WooCommerce Persian Shipping plugin (افزونه حمل و نقل ووکامرس) allows unauthenticated remote attackers to perform unauthorized state-changing actions by tricking an authenticated WordPress administrator into visiting a malicious page. Versions 4.4.5 and below are affected, with integrity impact rated High due to the potential for unauthorized modification of shipping configurations, order data, or plugin settings. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation requires victim interaction, moderating real-world risk despite the network-accessible attack vector.

Technical ContextAI

The vulnerability affects a WordPress WooCommerce plugin authored by Mahdi Yousefi, identified by CPE cpe:2.3:a:mahdi_yousefi:افزونه_حمل_و_نقل_ووکامرس_(پست_پیشتاز_و_سفارشی،_پیک_موتوری):*:*:*:*:*:*:*:* and targeting Persian-language e-commerce stores using Pishtaz Post and motorcycle courier integrations. CWE-352 (Cross-Site Request Forgery) indicates the plugin fails to validate that sensitive state-changing HTTP requests originate from the legitimate WordPress admin session - specifically the absence of nonce verification or equivalent anti-CSRF token checks on one or more plugin action handlers. WordPress plugins handling shipping logic typically expose AJAX or admin-post endpoints; without nonce validation, any page the victim visits can silently trigger those endpoints using the victim's authenticated browser session.

RemediationAI

Update the WooCommerce Persian Shipping plugin to a version beyond 4.4.5 that includes CSRF nonce validation - check the WordPress.org plugin changelog or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/persian-woocommerce-shipping/vulnerability/wordpress-fzonh-hml-o-nkl-oo-mrs-st-sht-z-o-sf-rsh-motor-plugin-4-4-5-cross-site-request-forgery-csrf-vulnerability for a confirmed patched release version, as the source data does not independently confirm an exact fix version number. If no patched version is yet available, a compensating control is to deactivate the plugin and use an alternative shipping method until a fix is released - this eliminates the attack surface entirely with the trade-off of losing Pishtaz Post and courier integration functionality. As a secondary measure, site administrators should avoid clicking unsolicited links while logged into the WordPress admin panel and should review recent shipping configuration changes for unauthorized modifications if exposure is suspected.