CVE-2026-39650

MediumCVSS 5.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

Missing Authorization vulnerability in UnitechPay up to version 1.0.2 allows exploiting incorrectly configured access control security levels.

Risk Assessment

Unauthorized users may gain access to administrative functions or data, potentially leading to integrity and confidentiality breaches.

Recommendation

Update the plugin to the latest version if available, or implement custom authorization mechanisms.

Original NVD description (English source)

Missing Authorization vulnerability in Unitech Web UnitechPay unitechpay-paiements-mobile-money allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UnitechPay: from n/a through <= 1.0.2.