CVE-2026-39685

CVE-2026-39685 is a Missing Authorization vulnerability affecting The Moneytizer plugin versions up to and including 10.0.10, which allows attackers to exploit incorrectly configured access control security levels. The vulnerability enables unauthorized users to perform actions they should not be permitted to execute due to improper authorization checks. The vulnerability carries a CVSS 3.1 score of 5.3 (Medium severity) with a network-based attack vector requiring no authentication or user interaction. While the attack has low complexity, the impact is limited to integrity violations with no confidentiality or availability compromise. The FAUCET Risk Score of 32 out of 100 indicates a moderate risk profile. There is currently no evidence of active exploitation in the wild, as indicated by the vulnerability's absence from the Known Exploited Vulnerabilities catalog and its inactive status on threat tracking lists. The EPSS score of 0.00037 suggests a very low probability of exploitation, with minimal community attention and no publicly available exploit code reported to date.