CVE-2026-39528

CVE-2026-39528 is a missing authorization vulnerability in the WP Delicious plugin for WordPress (versions through 1.9.5) that stems from incorrectly configured access control security levels in the delicious-recipes component. This flaw allows unauthorized users to bypass authentication controls and gain unauthorized access to sensitive functionality. The vulnerability carries a CVSS 3.1 score of 5.3 (Medium severity) with a network-based attack vector that requires no special privileges or user interaction. The attack has low complexity, meaning a threat actor with basic technical knowledge could exploit it. The primary impact is limited to confidentiality breach, with no integrity or availability impacts noted. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and carries an extremely low EPSS score of 0.00037. The low FAUCET risk score of 32.0 and inactive status on threat tracking lists suggest minimal community attention and exploit availability at this time.