CVE-2026-39659

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39659", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "REJECTED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-07T10:57:53.260Z", "datePublished": "2026-04-08T08:30:36.852Z", "dateUpdated": "2026-04-21T10:53:33.975Z", "dateRejected": "2026-04-21T10:53:33.975Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-21T10:53:33.975Z"}, "rejectedReasons": [{"lang": "en", "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}]}], "x_generator": {"engine": "Vulnogram 1.0.1"}}}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39659", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "REJECTED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-07T10:57:53.260Z", "datePublished": "2026-04-08T08:30:36.852Z", "dateUpdated": "2026-04-21T10:53:33.975Z", "dateRejected": "2026-04-21T10:53:33.975Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-21T10:53:33.975Z"}, "rejectedReasons": [{"lang": "en", "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}]}], "x_generator": {"engine": "Vulnogram 1.0.1"}}}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}], "id": "CVE-2026-39659", "lastModified": "2026-10-16T14:10:00.120", "metrics": {}, "published": "2026-04-08T09:16:37.110", "references": [], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Rejected"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.11.3]"}}], "enrichment": {"confidence": 98.0, "confidence_source": "matching", "scores": [{"score": 98.0, "source": "matching"}]}, "original": {"product": "Ultimate Member", "source": "cna", "vendor": "Ultimate Member"}, "product": "ultimate_member", "vendor": "ultimatemember"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-09T16:38:59.561148+00:00", "value": {"mitigation_remediation": ["Upgrade Ultimate Member to version 2.11.4 or later.", "If an upgrade is not immediately possible, review and tighten role permissions within the plugin settings.", "Restrict or disable any user\u2011editable fields that are not essential to site operation.", "Monitor site logs for anomalous activity that may indicate attempts to bypass access controls."], "summary": {"action": "Immediate Patch", "impact": "Broken Access Control"}, "threat_synthesis": {"affected_systems": "Ultimate Member plugin for WordPress (versions up to 2.11.3). No additional vendor or product details are provided beyond this range of versions.", "description_and_impact": "The vulnerability resides in Ultimate Member plugin versions up to and including 2.11.3. Incorrectly configured access control levels allow an attacker to perform actions that should be restricted to privileged users. This can lead to unauthorized modification of user profiles, sensitive data exposure, and potential control over site settings. The weakness is a missing authorization check, classified as CWE-862.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the nature of the plugin and the description, the likely attack vector is through the web interface, where an attacker could manipulate requests to bypass the missing authorization checks. No explicit prerequisites are stated, but the presence of the plugin on a WordPress site is required for exploitation."}}}}, "created": "2026-04-08T19:28:13.975817+00:00", "updated": "2026-04-10T09:40:40.734556+00:00", "vendors": ["ultimatemember", "ultimatemember$PRODUCT$ultimate_member", "wordpress", "wordpress$PRODUCT$wordpress"]}