CVE-2026-39569
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The 12 Step Meeting List plugin for WordPress up to version 3.19.9 lacks authorization, allowing exploitation of incorrectly configured access control security levels. Attackers can gain unauthorized access to features.
Risk Assessment
The organization risks unauthorized access to plugin features, potentially leading to data modification or privilege escalation.
Recommendation
Update the 12 Step Meeting List plugin to a version above 3.19.9 if available, or contact the vendor for a patch.
Other vulnerabilities in 12 Step Meeting List
See all- CVE-2026-66584High
Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List versions up to 3.19.16. Allows injecting malicious script into the page.
- CVE-2026-39570Medium
The WordPress plugin 12 Step Meeting List (12-step-meeting-list) by AA Web Servant has a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 3.19.9.
Original NVD description (English source)
Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 12 Step Meeting List: from n/a through <= 3.19.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS