CVE-2026-39655

MediumCVSS 5.3

Published: 26/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The Mayosis Core WordPress plugin up to version 5.4.7 suffers from a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

Risk Assessment

Unauthorized users may gain access to functions or data that should be protected, potentially leading to privilege escalation or information disclosure.

Recommendation

Update the Mayosis Core plugin to the latest available version that includes security fixes.

Other vulnerabilities in Mayosis Core

CVE-2026-32333High
The Mayosis Core plugin versions up to 5.4.7 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker without logging in can inject malicious scripts into pages.

Original NVD description (English source)

Missing Authorization vulnerability in TeconceTheme Mayosis Core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Mayosis Core: from n/a through 5.4.7.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS