CVE Catalog
CVE-2026-39689
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk0.28%
20th percentile - higher than 20% of all known CVEs
Summary
The eShipper Commerce plugin for WordPress up to version 2.16.12 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Risk Assessment
An attacker can gain unauthorized access to administrative functions or data, potentially leading to privilege escalation or information disclosure.
Recommendation
Update the eShipper Commerce plugin to version 2.16.13 or later, which contains a fix for this vulnerability.
Original NVD description (English source)
Missing Authorization vulnerability in eshipper eShipper Commerce eshipper-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eShipper Commerce: from n/a through <= 2.16.12.