CVE-2026-57786

HighCVSS 8.8

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

A CSRF vulnerability in the WorkScout-Core plugin allows authentication bypass. The issue affects all versions up to and including 1.7.08.

Risk Assessment

An attacker can exploit CSRF to perform unauthorized actions on behalf of an authenticated administrator, leading to account takeover or site configuration changes.

Recommendation

Immediately update the WorkScout-Core plugin to the latest available version and implement CSRF tokens in all forms.

Other vulnerabilities in WorkScout-Core

CVE-2026-52716Medium
In WorkScout-Core versions up to 1.7.11, there is a vulnerability allowing unauthenticated arbitrary file deletion.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core workscout-core allows Authentication Bypass.This issue affects WorkScout-Core: from n/a through <= 1.7.08.