CVE-2026-39509

CVE-2026-39509 is a missing authorization vulnerability in wpWax Directorist plugin versions 8.5.10 and earlier that allows attackers to bypass access controls due to incorrectly configured security levels. This authorization flaw enables unauthorized users to perform restricted actions within the plugin, potentially compromising data integrity and system functionality. The vulnerability has a CVSS v3.1 score of 5.3 (medium severity) with a network-based attack vector that requires no special privileges or user interaction, making it relatively easy to exploit. The primary impact is on integrity, as attackers can modify data, though confidentiality and availability are not directly affected according to the current assessment. There is no evidence of active exploitation in the wild, as the vulnerability is not included on the KEV catalog and maintains an inactive status on threat intelligence lists. The EPSS score of 0.00037 indicates minimal probability of exploitation compared to other CVEs, and no public exploit code has garnered significant community attention, suggesting limited real-world traction at this time.