CVE-2026-39669
Received Received - Intake
Missing Authorization in NitroPack ≤1.19.3 Enables Unauthorized Access

Publication date: 2026-04-08

Last updated on: 2026-04-28

Assigner: Patchstack

Description
Missing Authorization vulnerability in NitroPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NitroPack: from n/a through 1.19.3.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-08
Last Modified
2026-04-28
Generated
2026-06-16
AI Q&A
2026-04-08
EPSS Evaluated
2026-06-15
NVD
CVE-2026-39669
EUVD
EUVD-2026-20344
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
nitropack nitropack to 1.19.3 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-39669 is a Broken Access Control vulnerability in the WordPress NitroPack Plugin versions up to and including 1.19.3. It involves missing authorization, authentication, or nonce token checks within certain plugin functions.

This means that unauthenticated users may be able to perform actions that normally require higher privileges, potentially compromising the security of the site.

Compliance Impact

The provided information does not specify how the CVE-2026-39669 vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Impact Analysis

The vulnerability allows unauthenticated users to perform privileged actions, which can compromise site security.

Although the CVSS severity score is 5.3, indicating a low priority threat with limited impact and low likelihood of exploitation, such vulnerabilities are often targeted in mass-exploit campaigns affecting many websites regardless of their popularity or traffic.

Until a patch is released, users are advised to seek assistance from hosting providers or web developers to implement protective measures.

Detection Guidance

The vulnerability involves missing authorization and authentication checks within certain NitroPack plugin functions, allowing unauthenticated users to perform privileged actions.

However, there are no specific detection commands or network/system scanning instructions provided in the available information.

Mitigation Strategies

Since no official patch is currently available for this vulnerability, the recommended mitigation is to update the NitroPack plugin to a version beyond 1.19.3 once a patch is released.

Until then, users are advised to seek assistance from their hosting providers or web developers to implement protective measures.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-39669. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart