CVE-2026-39588

CVE-2026-39588 is a missing authorization vulnerability in nmerii's NM Gift Registry and Wishlist Lite WordPress plugin (versions up to 5.13) that allows attackers to exploit incorrectly configured access control security levels. The flaw enables unauthorized modification of sensitive data without proper permission checks. The vulnerability has a CVSS score of 5.3 (Medium severity) with a network-based attack vector requiring low complexity and no user interaction. While the impact is limited to integrity violations with no confidentiality or availability concerns, the lack of authentication requirements makes it accessible to unauthenticated threat actors. The EPSS score of 0.00037 indicates minimal probability of exploitation in the wild relative to other vulnerabilities. There is currently no evidence of active exploitation or known public exploit code, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. Community attention appears limited given the inactive status on exploit tracking lists. Organizations running this plugin should prioritize patching to versions beyond 5.13 as a standard maintenance measure, though immediate emergency response is not warranted given the current threat landscape.