{"id":"CVE-2026-39718","published":"2026-10-02T20:17:02.420","lastModified":"2026-10-06T15:04:25.990","description":"Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet allows Cross Site Request Forgery.This issue affects Wallstreet: from n/a through 2.8.6.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/wallstreet/vulnerability/wordpress-wallstreet-theme-2-8-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A Cross-Site Request Forgery (CSRF) vulnerability exists in Webriti Wallstreet wallstreet versions from n/a through 2.8.6, allowing attackers to forge requests and perform unauthorized actions on behalf of authenticated users.","exploitability":"Exploitation is relatively straightforward as it requires the victim to be logged in and tricked into performing an action on the attacker's behalf. Precondition is that the victim must be authenticated and on the same domain.","blast_radius":"If exploited, this could lead to unauthorized actions being performed on the victim's account, potentially resulting in data loss or financial harm.","remediation":"Upgrade to Wallstreet version 2.8.7 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["csrf","web","auth","vulnerability"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-03T08:54:27.908Z"}}