What is the CVSS score of EUVD-2026-39756?

EUVD-2026-39756 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Real Estate 7 EUVD-2026-39756

| CVE-2026-57641 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-26 audit@patchstack.com

GHSA-wr7m-w6xj-frxv

WordPress CSRF Wordpress Theme

6.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

7.1 HIGH

PR:N reflects attacker requires no credentials; UI:R mandatory per CSRF nature; I:L added independently as CSRF enabling any unauthorized action implies at minimum low integrity impact, contrasting with NVD's I:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:11 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= 3.5.9 versions.

AnalysisAI

Cross-Site Request Forgery in the Real Estate 7 WordPress theme (versions <= 3.5.9) enables unauthenticated remote attackers to forge destructive HTTP requests on behalf of authenticated users, with the CVSS vector indicating high availability impact - consistent with forced deletion of property listings or site content rather than data exposure or modification. Exploitation requires luring an authenticated WordPress session holder to a malicious page, making it a social-engineering-dependent attack. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.

Technical ContextAI

CWE-352 (Cross-Site Request Forgery) arises when a web application processes state-changing requests without verifying that they originate from the legitimate user session. WordPress themes are expected to validate wp_nonce values on all actions that modify or delete data; absence of this check in Real Estate 7 allows a forged cross-origin request to be processed as if issued by the authenticated user. The affected product is the 'realestate-7' WordPress theme, a frontend property-listing and real-estate-focused WordPress theme, versions up to and including 3.5.9. The CVSS vector (C:N/I:N/A:H) specifically points to an endpoint capable of triggering destructive deletion or disruption rather than data theft or tampering.

RemediationAI

Update the Real Estate 7 WordPress theme to a version beyond 3.5.9; the Patchstack advisory at https://patchstack.com/database/wordpress/theme/realestate-7/vulnerability/wordpress-real-estate-7-theme-3-5-9-cross-site-request-forgery-csrf-vulnerability should be consulted for the confirmed fixed release, as no specific patch version was identified in the available intelligence. Upstream fix version is not independently confirmed from the provided data. As a compensating control where immediate update is not feasible, restrict WordPress admin dashboard access to trusted IP ranges via web server or firewall rules, which reduces the attack surface by limiting who can hold authenticated sessions reachable by a CSRF payload. Additionally, security-conscious site operators can deploy a WAF with CSRF protection rules (e.g., blocking cross-origin POST requests lacking a valid referrer header), though this may interfere with legitimate third-party integrations.