CVE-2026-39776
Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: Patchstack

Description
Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-19
AI Q&A
2026-10-06
EPSS Evaluated
2026-10-18
NVD
CVE-2026-39776
EUVD
EUVD-2026-93026

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpshopmart Tabs n/a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Remote Code Execution (RCE) flaw in the WordPress Tabs Plugin versions up to and including 2.5. It allows attackers to execute arbitrary commands on the server remotely, posing a significant security risk.

Detection Guidance

Check if the Tabs plugin version 2.5 or below is installed on your WordPress site. Look for unauthorized code execution attempts in server logs or unusual network traffic patterns. Patchstack provides automated detection tools for this vulnerability.

Impact Analysis

Attackers could exploit this to run malicious code on your server, potentially leading to data breaches, unauthorized access, or complete system compromise. Even low-traffic websites are at risk.

Compliance Impact

This RCE vulnerability could lead to unauthorized data access or exfiltration, violating GDPR and HIPAA requirements for data protection and confidentiality. Non-compliance may result in legal penalties.

Mitigation Strategies

Disable the Tabs plugin immediately if installed. Apply Patchstack's temporary mitigation rule to block attacks. Contact your hosting provider or developer for further assistance. Avoid using untrusted plugins until an official patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39776. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart