CVE-2026-39607
Received Received - Intake
Missing Authorization in Wpbens Filter Plus ≤1.1.17 Enables Access Abuse

Publication date: 2026-04-08

Last updated on: 2026-04-10

Assigner: Patchstack

Description
Missing Authorization vulnerability in Wpbens Filter Plus filter-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filter Plus: from n/a through <= 1.1.17.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-08
Last Modified
2026-04-10
Generated
2026-06-16
AI Q&A
2026-04-08
EPSS Evaluated
2026-06-15
NVD
CVE-2026-39607
EUVD
EUVD-2026-20240
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
wpbens filter_plus to 1.1.17 (inc)
wpbens filter_plus From 1.0.0 (inc) to 1.1.17 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-39607 is a Broken Access Control vulnerability in the WordPress Filter Plus Plugin versions up to and including 1.1.17. It occurs due to missing authorization, authentication, or nonce token checks within certain plugin functions.

This flaw allows unprivileged users, such as subscribers, to perform actions that should be restricted to higher-privileged roles like developers.

It is classified under the OWASP Top 10 category A1: Broken Access Control.

Impact Analysis

The vulnerability allows unauthorized users to perform privileged actions, potentially compromising the security and integrity of the affected WordPress site.

However, the CVSS severity score is 5.4, indicating a low priority and low severity impact.

While it can be exploited in mass campaigns targeting many websites, it is considered unlikely to be exploited with significant impact.

No official patch is currently available, so immediate mitigation involves updating the plugin if possible or seeking help from hosting providers or web developers.

Detection Guidance

There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.

Mitigation Strategies

Immediate mitigation involves updating the affected Filter Plus plugin if an update is available.

If no official patch is available, seek assistance from your hosting provider or web developers to implement protective measures.

Patchstack also provides vulnerability mitigation services that can help protect affected sites.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39607. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart