EUVD-2026-20263
GHSA-pgqw-m834-qpv3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious webpage with CSRF payload
-
ExploitTrick admin into visiting page
-
ExecutionSubmit unauthorized file upload request
-
ImpactExecute web shell on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must be logged into SpicePress <= 2.3.2.5 and click a link or visit a page crafted by the attacker. Remote unauthenticated attacker performs CSRF to upload web shell via authenticated user's session. |
| Impact | CVSS 8.8 reflects high impact (confidentiality, integrity, availability), but exploitation requires user interaction (UI:R) and unauthenticated network access. EPSS 0.01% indicates low observed exploitation activity. Real-world risk depends on SpicePress adoption and admin user targets; web shell upload would enable full site compromise if successful. |
| Exploit ScenarioDerived | Attacker crafts malicious link/form embedding CSRF payload targeting authenticated admin. Admin clicks link while logged into SpicePress dashboard; CSRF triggers unauthenticated file upload installing web shell. No public exploit code identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
CSRF vulnerability in SpicePress WordPress theme versions ≤2.3.2.5 enables unauthenticated attackers to upload web shells via arbitrary plugin installation, achieving remote code execution. Successful exploitation requires user interaction (victim must click malicious link while authenticated). No public exploit identified at time of analysis. CVSS 8.8 score reflects network-accessible, low-complexity attack with high impact to confidentiality, integrity, and availability.
RemediationAI
No vendor-released patch identified at time of analysis for SpicePress 2.3.2.5. Recommended immediate actions: (1) Deactivate SpicePress theme and migrate to actively maintained alternative WordPress theme; (2) Audit installed plugins for unauthorized additions; (3) Implement Web Application Firewall rules blocking unauthorized plugin uploads; (4) Monitor Patchstack advisory for vendor update: https://patchstack.com/database/Wordpress/Theme/spicepress/vulnerability/wordpress-spicepress-theme-2-3-2-5-csrf-to-arbitrary-plugin-installation-vulnerability?_s_id=cve. Workaround: Restrict WordPress admin access to trusted IP ranges via .htaccess or firewall ACLs. EPSS 0.01% indicates low observed exploitation activity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-352 CSRF flaw permits state-changing operations without request verification tokens. Attack chain leverages missing anti-CSRF protections in theme's plugin installation mechanism, allowing HTTP request forgery to install malicious plugins containing web shells. cpe:2.3:a:spicethemes:spicepress references WordPress theme component vulnerable through upload functionality.
Know when Spicepress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Cross-Site Request Forgery (CSRF) vulnerability in spicethemes SpicePress spicepress allows Upload a Web Shell to a Web Server.This issue affects SpicePress: from n/a through <= 2.3.2.5.
Executive ViewAI
CVE-2026-39621 is a critical CSRF vulnerability in SpicePress WordPress theme (versions ≤2.3.2.5) that allows unauthenticated attackers to trick authenticated administrators into installing malicious plugins, resulting in remote code execution and complete system compromise. Organizations using this theme face immediate risk of data breach, website defacement, and infrastructure takeover if administrators are socially engineered into clicking malicious links.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement CSRF token validation at the web application firewall level for WordPress admin endpoints; (2) Restrict plugin installation permissions to only essential administrator accounts; (3) Require multi-factor authentication for all WordPress administrative accounts; (4) Deploy Content Security Policy (CSP) headers to block malicious cross-site requests; (5) Monitor WordPress plugin installation logs and audit trails for unauthorized activity; (6) Consider temporary deactivation of the SpicePress theme and use a hardened alternative.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Exploit-DB