CVE-2026-39641

MediumCVSS 6.5

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

The Blackfyre plugin for WordPress is vulnerable to CSRF attacks. An attacker can trick an administrator into performing unintended actions.

Risk Assessment

Risk of unauthorized changes to plugin or site configuration by leveraging the administrator's session.

Recommendation

Update the Blackfyre plugin to the latest available version.

Original NVD description (English source)

Cross-Site Request Forgery (CSRF) vulnerability in Skywarrior Blackfyre blackfyre allows Cross Site Request Forgery.This issue affects Blackfyre: from n/a through <= 2.5.4.