CVE-2026-57766
Deferred Deferred - Pending Action

Unauthenticated CSRF in WPIDE File Manager & Code Editor

Publication date: 2026-07-02

Last updated on: 2026-07-02

Assigner: Patchstack

Description
Unauthenticated Cross Site Request Forgery (CSRF) in WPIDE – File Manager & Code Editor <= 3.5.6 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-02
Last Modified
2026-07-02
Generated
2026-07-02
AI Q&A
2026-07-02
EPSS Evaluated
N/A
NVD
CVE-2026-57766
EUVD
EUVD-2026-41321

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
patchstack wpide_file_manager_and_code_editor to 3.5.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability is an unauthenticated Cross Site Request Forgery (CSRF) in the WordPress plugin WPIDE – File Manager & Code Editor, versions 3.5.6 and below.

It allows attackers to trick higher privileged users into executing unwanted actions by making them click a malicious link or submit a form while authenticated.

Although the CVSS score is high at 8.8, the vulnerability requires user interaction and is considered to have a low severity impact with no significant consequences.

Impact Analysis

If exploited, attackers could force users with higher privileges to perform unintended actions on the affected WordPress site.

However, the impact is considered low severity and unlikely to be exploited due to the need for user interaction.

There is no official patch available, so users are advised to update the plugin or seek assistance from their hosting provider or web developer.

Mitigation Strategies

The vulnerability affects WPIDE – File Manager & Code Editor versions 3.5.6 and below and is a Cross Site Request Forgery (CSRF) issue.

Since there is no official patch available, immediate mitigation steps include:

  • Update the WPIDE plugin to a version above 3.5.6 if available.
  • If updating is not possible, seek assistance from your hosting provider or web developer to implement custom protections.
  • Educate users to avoid clicking on suspicious links or submitting untrusted forms while authenticated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57766. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart