CVE-2026-39686
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The BSK PDF Manager plugin for WordPress (versions up to 3.7.2) exposes sensitive system information to unauthorized entities, allowing retrieval of embedded sensitive data.
Risk Assessment
An attacker can access confidential data stored in PDF files, potentially leading to information disclosure.
Recommendation
Update the BSK PDF Manager plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in BSK PDF Manager
See all- CVE-2026-65528Medium
The BSK PDF Manager plugin versions up to 3.8 contain a Cross Site Scripting (XSS) vulnerability exploitable by contributors. A contributor can inject malicious JavaScript code.
- CVE-2025-4970Medium
The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to and including 3.7.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Administrator-level access and above to inject arbitrary web scripts that execute when a user accesses the SVG file. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Original NVD description (English source)
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Retrieve Embedded Sensitive Data.This issue affects BSK PDF Manager: from n/a through <= 3.7.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS