CVE-2026-39639

CVE-2026-39639 is a missing authorization vulnerability in Red Pixel Studios' RPS Include Content plugin (versions through 1.2.2) that allows attackers to exploit incorrectly configured access control security levels. This flaw enables unauthorized users to perform privileged actions they should not have permission to execute within the affected plugin. The vulnerability carries a CVSS score of 6.5 (Medium severity) with a network-based attack vector requiring low complexity and valid user credentials, but no user interaction. The primary impact is integrity compromise, meaning attackers can modify or manipulate content, though confidentiality and availability are not directly affected. The vulnerability currently shows minimal exploitation activity, with no public evidence of active exploitation in the wild. It does not appear on CISA's Known Exploited Vulnerabilities (KEV) list and has an extremely low EPSS score of 0.0003, indicating it ranks lower than 99.9% of all CVEs in terms of exploitation probability. Community attention remains low, suggesting this issue has not gained significant security researcher focus or media attention.