CVE Catalog
CVE-2026-39620
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk0.14%
4th percentile - higher than 4% of all known CVEs
Summary
A Cross-Site Request Forgery (CSRF) vulnerability in the Appointment WordPress plugin allows uploading a web shell to the server. An attacker can trick an administrator into performing unintended actions.
Risk Assessment
An attacker can gain remote access to the server, leading to full system compromise.
Recommendation
Update the Appointment plugin to version later than 3.5.5. Implement CSRF protections.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Appointment appointment allows Upload a Web Shell to a Web Server.This issue affects Appointment: from n/a through <= 3.5.5.