PatchSiren cyber security CVE debrief

CVE-2026-61956 hamsalam CVE debrief

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the ووسلام – همگام سازی ووکامرس و باسلام plugin for WordPress. This issue affects versions from n/a through 1.9.1. The vulnerability has a CVSS score of 7.1 and a severity rating of HIGH. Users should be aware of this vulnerability and take steps to mitigate it. The plugin does not properly validate user requests, allowing an attacker to perform unauthorized actions. Administrators, security teams, and operators who manage WordPress installations with this plugin should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review.

Vendor: hamsalam
Product: ووسلام – همگام سازی ووکامرس و باسلام
CVSS: HIGH 7.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-07-13
Original CVE updated: 2026-07-13
Advisory published: 2026-07-13
Advisory updated: 2026-07-13

Who should care

Users of the ووسلام – همگام سازی ووکامرس و باسلام plugin for WordPress should be aware of this CSRF vulnerability and take steps to mitigate it. This includes administrators, security teams, and operators who manage WordPress installations with this plugin.

Technical summary

The ووسلام – همگام سازی ووکامرس و باسلام plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF). The vulnerability has been assigned a CVSS score of 7.1 and a severity rating of HIGH. The plugin does not properly validate user requests, allowing an attacker to perform unauthorized actions.

Defensive priority

High priority should be given to updating the plugin to a version that addresses this vulnerability.

Recommended defensive actions

Update the ووسلام – همگام سازی ووکامرس و باسلام plugin to a version greater than 1.9.1.
Implement additional security measures such as validating user requests and ensuring proper CSRF protection mechanisms are in place.
Review compensating controls for exposed systems while remediation is scheduled and verified.
Check relevant monitoring, detection, and logs for exposed assets that need extra review.
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-07-13T10:16:46.573Z and has not been modified since then. The NVD entry is currently 7.1 HIGH. The vulnerability affects ووسلام – همگام سازی ووکامرس و باسلام plugin for WordPress, with versions from n/a through 1.9.1 being vulnerable. Evidence is limited to CVE and NVD details.

Sources and references

Verified primary and authoritative sources

CVE-2026-61956 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-61956

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-61956 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-61956

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.