CVE-2026-39715

CVE-2026-39715 is a missing authorization vulnerability affecting AnyTrack Affiliate Link Manager versions 1.5.5 and earlier, stemming from incorrectly configured access control security levels. The flaw allows unauthorized users to bypass authentication mechanisms and access restricted functionality within the plugin. The vulnerability has a CVSS score of 5.3 (Medium severity) with a network-based attack vector requiring no authentication or user interaction. While the attack is straightforward to execute with low complexity, the impact is limited to integrity violations, with no confidentiality or availability damage expected. The FAUCET risk score of 41.0/100 indicates moderate concern within the broader threat landscape. There is currently no evidence of active exploitation, as the vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and is not listed on active hot lists. The extremely low EPSS score of 0.00037 suggests minimal real-world exploit activity to date. However, organizations running affected versions should still prioritize patching to prevent potential unauthorized access to affiliate link management functions.