CVE-2026-39476

MediumCVSS 4.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

The User Feedback plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.10.1.

Risk Assessment

An attacker can gain unauthorized access to user feedback, potentially leading to sensitive data leakage or content manipulation.

Recommendation

Update the User Feedback plugin to the latest version and verify access permissions.

Original NVD description (English source)

Missing Authorization vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Feedback: from n/a through <= 1.10.1.