CVE-2026-39526

14th percentile - higher than 14% of all known CVEs

The WpStream plugin contains an authorization bypass vulnerability through a user-controlled key, allowing exploitation of incorrectly configured access control security levels. This issue affects all versions from n/a through 4.11.2 (excluding 4.11.2).

An attacker can manipulate user keys to bypass authorization mechanisms and gain access to streaming functions or sensitive data, potentially leading to privilege escalation.

Immediately update the WpStream plugin to version 4.11.2 or later and verify access control configuration.