CVE-2026-39527
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
WpStream versions below 4.11.2 have a vulnerability allowing subscribers to upload arbitrary files.
Risk Assessment
This vulnerability may lead to unauthorized access to the system and potential introduction of malicious software.
Recommendation
It is recommended to update WpStream to version 4.11.2 or newer to mitigate this vulnerability.
Other vulnerabilities in WpStream
See all- CVE-2026-39526Medium
The WpStream plugin contains an authorization bypass vulnerability through a user-controlled key, allowing exploitation of incorrectly configured access control security levels. This issue affects all versions from n/a through 4.11.2 (excluding 4.11.2).
- CVE-2023-38512Medium
The WpStream plugin has a Cross-Site Request Forgery (CSRF) vulnerability, allowing unauthorized actions on behalf of the user. This issue affects versions from n/a to 4.5.4.
Original NVD description (English source)
Subscriber Arbitrary File Upload in WpStream < 4.11.2 versions.