CVE-2026-39698

CVE-2026-39698 is a missing authorization vulnerability in The Publisher Desk ads.txt plugin affecting versions 1.5.0 and earlier. This flaw allows attackers to exploit improperly configured access control security levels to gain unauthorized access to sensitive information. The vulnerability stems from insufficient authorization checks in the application's access control mechanisms. The vulnerability carries a CVSS 3.1 score of 5.3 (Medium severity) and can be exploited remotely over a network without authentication or user interaction required. The attack has low complexity and results in limited confidentiality impact, though integrity and availability are not affected. The EPSS score of 0.00037 indicates this vulnerability is currently among the lower-probability threats compared to other published CVEs. There are no confirmed public exploits or active exploitation attempts documented for this vulnerability at this time. The CVE is not listed on the Known Exploited Vulnerabilities Catalog (KEV) and remains inactive on vulnerability hotlists, suggesting minimal community attention or real-world weaponization. Organizations using The Publisher Desk ads.txt should prioritize patching to versions beyond 1.5.0, though the low exploitation risk should be balanced against other security priorities.