CVE-2026-39701

MediumCVSS 5.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

The WordPress plugin ShopWP (wpshopify) has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This affects versions up to and including 5.2.4.

Risk Assessment

An attacker may gain unauthorized access to functions or data, potentially leading to privilege escalation or information disclosure.

Recommendation

Update the ShopWP plugin to a version above 5.2.4 if a patch is available, or apply other access control hardening measures.

Original NVD description (English source)

Missing Authorization vulnerability in Andrew ShopWP wpshopify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopWP: from n/a through <= 5.2.4.