Skip to content
OpenAdvisories
Critical · 9.6 CVE-2026-39620 EUVD-2026-20262GHSA-5rf8-xhgp-9mg9

WordPress Appointment theme <= 3.5.5 - Cross Site Request Forgery (CSRF) to Arbitrary File Upload vulnerability

Published Apr 8, 2026 · Updated Apr 29, 2026 · Assigned by Patchstack

Vendor: priyanshumittal Product: Appointment

Description

Cross-Site Request Forgery (CSRF) vulnerability in priyanshumittal Appointment appointment allows Upload a Web Shell to a Web Server.This issue affects Appointment: from n/a through <= 3.5.5.

Affected products

VendorProductAffectedFixed
priyanshumittal Appointment ≤ 3.5.5 —

References