CVE-2026-39607
Missing Authorization in Wpbens Filter Plus ≤1.1.17 Enables Access Abuse
Publication date: 2026-04-08
Last updated on: 2026-04-10
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wpbens | filter_plus | to 1.1.17 (inc) |
| wpbens | filter_plus | From 1.0.0 (inc) to 1.1.17 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-39607 is a Broken Access Control vulnerability in the WordPress Filter Plus Plugin versions up to and including 1.1.17. It occurs due to missing authorization, authentication, or nonce token checks within certain plugin functions.
This flaw allows unprivileged users, such as subscribers, to perform actions that should be restricted to higher-privileged roles like developers.
It is classified under the OWASP Top 10 category A1: Broken Access Control.
How can this vulnerability impact me? :
The vulnerability allows unauthorized users to perform privileged actions, potentially compromising the security and integrity of the affected WordPress site.
However, the CVSS severity score is 5.4, indicating a low priority and low severity impact.
While it can be exploited in mass campaigns targeting many websites, it is considered unlikely to be exploited with significant impact.
No official patch is currently available, so immediate mitigation involves updating the plugin if possible or seeking help from hosting providers or web developers.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information provided about detection methods or commands to identify this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the affected Filter Plus plugin if an update is available.
If no official patch is available, seek assistance from your hosting provider or web developers to implement protective measures.
Patchstack also provides vulnerability mitigation services that can help protect affected sites.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.