CVE-2026-39602

MediumCVSS 5.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

The Order Tracking plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.4.3.

Risk Assessment

An attacker can gain unauthorized access to order tracking data or modify it, compromising the integrity of the order process.

Recommendation

Update the Order Tracking plugin to a version that includes a fix for this vulnerability.

Original NVD description (English source)

Missing Authorization vulnerability in Rustaurius Order Tracking order-tracking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Tracking: from n/a through <= 3.4.3.