CVE-2026-39477

MediumCVSS 4.3

Published: 08/04/2026(UTC)Updated: 20/07/2026(UTC)Translated: 21/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

The CartFlows WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 2.2.3.

Risk Assessment

An attacker may gain unauthorized access to administrative functions or data, potentially leading to privilege escalation and compromise of system integrity.

Recommendation

Immediately update the CartFlows plugin to the latest available version that addresses this vulnerability.

Original NVD description (English source)

Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartFlows: from n/a through <= 2.2.3.