CVE-2026-39621 - Vulnerability Analysis

Overview

spicethemes SpicePress <= 2.3.2.5 contains a cross site request forgery vulnerability caused by insufficient request validation, letting attackers upload a web shell to the web server, exploit requires victim interaction.

Severity & Score

Impact

Attackers can upload a web shell to the server, leading to full server compromise.

Mitigation

Update to the latest version beyond 2.3.2.5.

References

• https://patchstack.com/database/Wordpress/Theme/spicepress/vulnerability/wordpress-spicepress-theme-2-3-2-5-csrf-to-arbitrary-plugin-installation-vulnerability?_s_id=cve

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner