CVE-2026-39620
CSRF in Appointment ≤3.5.5 Enables Web Shell Upload
Publication date: 2026-04-08
Last updated on: 2026-04-14
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| priyanshumittal | appointment | to 3.5.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the CVE-2026-39620 vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-39620 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the WordPress Appointment Theme versions up to and including 3.5.5.
This vulnerability allows attackers to trick privileged users into performing unwanted actions while they are authenticated, such as uploading a web shell to the web server.
Exploitation requires user interaction from a privileged user, for example by clicking a malicious link or visiting a crafted page.
How can this vulnerability impact me? :
Successful exploitation of this vulnerability can lead to an attacker uploading a web shell to the web server, which can compromise the server's security.
This can allow attackers to execute arbitrary commands on the server, potentially leading to data breaches, unauthorized access, or further attacks.
The vulnerability has a high severity score of 9.6, indicating a critical risk, and can be exploited in mass campaigns targeting many websites.
What immediate steps should I take to mitigate this vulnerability?
The immediate recommended action is to update the affected Appointment theme plugin to a version beyond 3.5.5 or replace the theme entirely.
If updating is not possible, users should seek assistance from their hosting provider or web developer.
Deactivating the theme alone does not eliminate the security risk unless a specific mitigation rule from Patchstack is applied.