CVE-2026-39570
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The WordPress plugin 12 Step Meeting List (12-step-meeting-list) by AA Web Servant has a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 3.19.9.
Risk Assessment
An attacker may intercept sensitive data transmitted by the plugin, potentially leading to information disclosure or further security breaches.
Recommendation
Update the 12 Step Meeting List plugin to a version above 3.19.9 if a patch is available, or audit configuration for data leakage.
Other vulnerabilities in 12 Step Meeting List
See all- CVE-2026-66584High
Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List versions up to 3.19.16. Allows injecting malicious script into the page.
- CVE-2026-39569Medium
The 12 Step Meeting List plugin for WordPress up to version 3.19.9 lacks authorization, allowing exploitation of incorrectly configured access control security levels. Attackers can gain unauthorized access to features.
Original NVD description (English source)
Insertion of Sensitive Information Into Sent Data vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Retrieve Embedded Sensitive Data.This issue affects 12 Step Meeting List: from n/a through <= 3.19.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS