CVE-2026-39669
Missing Authorization in NitroPack ≤1.19.3 Enables Unauthorized Access
Publication date: 2026-04-08
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nitropack | nitropack | to 1.19.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-39669 is a Broken Access Control vulnerability in the WordPress NitroPack Plugin versions up to and including 1.19.3. It involves missing authorization, authentication, or nonce token checks within certain plugin functions.
This means that unauthenticated users may be able to perform actions that normally require higher privileges, potentially compromising the security of the site.
How can this vulnerability impact me? :
The vulnerability allows unauthenticated users to perform privileged actions, which can compromise site security.
Although the CVSS severity score is 5.3, indicating a low priority threat with limited impact and low likelihood of exploitation, such vulnerabilities are often targeted in mass-exploit campaigns affecting many websites regardless of their popularity or traffic.
Until a patch is released, users are advised to seek assistance from hosting providers or web developers to implement protective measures.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability involves missing authorization and authentication checks within certain NitroPack plugin functions, allowing unauthenticated users to perform privileged actions.
However, there are no specific detection commands or network/system scanning instructions provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
Since no official patch is currently available for this vulnerability, the recommended mitigation is to update the NitroPack plugin to a version beyond 1.19.3 once a patch is released.
Until then, users are advised to seek assistance from their hosting providers or web developers to implement protective measures.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the CVE-2026-39669 vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.