CVE-2026-39526

CVE-2026-39526 is an Authorization Bypass Through User-Controlled Key vulnerability affecting WpStream plugin versions prior to 4.11.2. The flaw stems from incorrectly configured access control security levels that can be exploited by authenticated users to bypass authorization mechanisms. The vulnerability carries a CVSS score of 5.4 (Medium severity) with a network-based attack vector requiring low complexity and user authentication. While confidentiality is not impacted, successful exploitation could result in integrity and availability impacts, allowing attackers to modify data or cause service disruption. There is currently no evidence of active exploitation in the wild, as indicated by the absence of this CVE from the Known Exploited Vulnerabilities catalog and its inactive status on threat hotlists. The EPSS score of 0.0004 suggests minimal probability of exploitation attempts, indicating low community and attacker attention at this time.