CVE-2026-39526
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The WpStream plugin contains an authorization bypass vulnerability through a user-controlled key, allowing exploitation of incorrectly configured access control security levels. This issue affects all versions from n/a through 4.11.2 (excluding 4.11.2).
Risk Assessment
An attacker can manipulate user keys to bypass authorization mechanisms and gain access to streaming functions or sensitive data, potentially leading to privilege escalation.
Recommendation
Immediately update the WpStream plugin to version 4.11.2 or later and verify access control configuration.
Other vulnerabilities in WpStream
See all- CVE-2026-39527Medium
WpStream versions below 4.11.2 have a vulnerability allowing subscribers to upload arbitrary files.
- CVE-2023-38512Medium
The WpStream plugin has a Cross-Site Request Forgery (CSRF) vulnerability, allowing unauthorized actions on behalf of the user. This issue affects versions from n/a to 4.5.4.
Original NVD description (English source)
Authorization Bypass Through User-Controlled Key vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through < 4.11.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS