CVE-2026-39619
CSRF in Busiprof ≤ 2.5.2 Enables Web Shell Upload
Publication date: 2026-04-08
Last updated on: 2026-04-09
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| priyanshumittal | busiprof | to 2.5.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the CVE-2026-39619 vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific detection method or commands provided for identifying the CVE-2026-39619 vulnerability on your network or system.
Since this vulnerability involves Cross-Site Request Forgery (CSRF) allowing arbitrary file upload via the Busiprof WordPress theme (versions up to 2.5.2), detection typically requires checking the version of the Busiprof theme installed on your WordPress site.
You can verify the theme version by accessing your WordPress admin dashboard or by inspecting the theme files directly.
No official patch or automated detection tools are currently available, so manual verification is necessary.
Can you explain this vulnerability to me?
CVE-2026-39619 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Busiprof Theme versions up to and including 2.5.2.
This vulnerability allows an attacker to trick privileged users into executing unwanted actions while authenticated, such as uploading a web shell to the web server.
The attacker can achieve this by making the privileged user click a malicious link, visit a crafted page, or submit a form.
Although the attack can be initiated without authentication, successful exploitation requires interaction from a privileged user.
How can this vulnerability impact me? :
This vulnerability can have a critical impact as it allows attackers to upload a web shell to the web server, potentially leading to full server compromise.
With a high CVSS severity score of 9.6, it can be used in mass-exploit campaigns targeting thousands of websites regardless of their traffic or popularity.
Successful exploitation could allow attackers to execute arbitrary commands on the server, steal data, or deface the website.
However, the Patchstack report notes the priority as low and the impact as unlikely to be exploited with significant effect, possibly due to the requirement of privileged user interaction.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation involves updating the affected Busiprof theme to a fixed version. However, since no official patch is currently available for this vulnerability, users are advised to seek assistance from their hosting provider or web developer.
Because the vulnerability allows attackers to trick privileged users into executing unwanted actions, it is also recommended to limit privileged user interactions with untrusted links or pages until a patch is available.