CVE-2026-57786: WorkScout-Core CSRF Auth Bypass Flaw

CVE-2026-57786 Overview

CVE-2026-57786 is a Cross-Site Request Forgery (CSRF) vulnerability in the purethemes WorkScout-Core WordPress plugin. The flaw affects all versions up to and including 1.7.08 and enables authentication bypass when a targeted user visits an attacker-controlled page. The issue is tracked under CWE-352 and carries a network attack vector requiring user interaction. Exploitation can lead to unauthorized access to WordPress accounts protected by the WorkScout job board platform.

Critical Impact
A successful CSRF attack against an authenticated WorkScout user can bypass authentication controls and yield high impact to confidentiality, integrity, and availability of the target WordPress site.

Affected Products

purethemes WorkScout-Core plugin for WordPress
All versions from the initial release through 1.7.08
WordPress sites deploying the WorkScout job board theme ecosystem

Discovery Timeline

2026-07-13 - CVE-2026-57786 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57786

Vulnerability Analysis

The WorkScout-Core plugin exposes state-changing authentication endpoints without validating anti-CSRF tokens. WordPress plugins are expected to enforce nonce validation using wp_verify_nonce() or check_admin_referer() on requests that modify authentication state. The affected plugin omits these checks on paths tied to session and account handling.

An attacker crafts a malicious HTML page hosting an auto-submitting form or image tag targeting the vulnerable endpoint. When an authenticated site user or administrator loads the page, the browser transmits the request with valid session cookies. The plugin processes the request as legitimate and performs the authentication-related action on the victim's behalf.

Because the flaw bypasses authentication, an unauthenticated remote attacker can influence privileged actions without harvesting credentials. The impact scales with the privilege level of the tricked user, and administrator accounts represent the highest-value targets.

Root Cause

The root cause is missing or improperly validated CSRF tokens on authentication-related handlers within workscout-core. Requests are trusted based solely on session cookies, which browsers attach automatically to cross-origin submissions.

Attack Vector

Exploitation requires the victim to visit an attacker-controlled URL or a page containing malicious markup, such as an <img> tag, hidden <form>, or JavaScript fetch() call targeting the WordPress site. No prior privileges on the target site are required by the attacker. The vulnerability manifests over the network and can be delivered through phishing, malvertising, or compromised third-party sites. See the Patchstack CSRF Vulnerability Advisory for additional context.

Detection Methods for CVE-2026-57786

Indicators of Compromise

HTTP POST requests to WorkScout authentication endpoints with Referer headers pointing to external, unrelated domains
Authentication state changes or session events for WordPress users that lack a preceding login page request in access logs
Unexpected creation, modification, or elevation of WordPress user accounts tied to WorkScout functionality
Requests missing the _wpnonce parameter or containing an invalid nonce value on authentication-sensitive routes

Detection Strategies

Inspect WordPress access logs for cross-origin Referer or Origin headers on plugin endpoints under wp-content/plugins/workscout-core/
Correlate WordPress user_login and profile_update action hooks with the originating HTTP request context to detect off-site initiation
Deploy a web application firewall rule that flags state-changing requests to WorkScout endpoints without a matching same-origin Origin header

Monitoring Recommendations

Enable verbose audit logging for WordPress authentication events using a security plugin or SIEM forwarder
Alert on administrator-level account changes originating from unauthenticated or unusual source IPs
Track version metadata of the WorkScout-Core plugin across managed sites to identify unpatched installations

How to Mitigate CVE-2026-57786

Immediate Actions Required

Update WorkScout-Core to a version later than 1.7.08 as soon as the vendor publishes a fix
Force logout of all active WordPress sessions and rotate administrator credentials on affected sites
Restrict administrative access to trusted networks or VPN endpoints until patching is complete
Review WordPress user tables for unauthorized accounts or unexpected role changes

Patch Information

As of the NVD publication date, refer to the Patchstack CSRF Vulnerability Advisory for the latest fixed-version information from purethemes. Apply the vendor update through the WordPress plugin manager once available.

Workarounds

Deploy a web application firewall rule blocking cross-origin POST requests to WorkScout-Core endpoints
Enforce the SameSite=Strict attribute on WordPress session cookies where compatible with site functionality
Temporarily disable the WorkScout-Core plugin on high-value sites until a patched release is installed
Require multi-factor authentication for administrator accounts to reduce impact of session abuse

bash

# Example WAF rule (ModSecurity) blocking cross-origin POSTs to workscout-core
SecRule REQUEST_URI "@contains /wp-content/plugins/workscout-core/" \
    "chain,phase:2,deny,status:403,id:1057786,msg:'CVE-2026-57786 CSRF block'"
    SecRule REQUEST_METHOD "@streq POST" "chain"
    SecRule &REQUEST_HEADERS:Origin "@eq 1,chain"
    SecRule REQUEST_HEADERS:Origin "!@beginsWith https://your-site.example"