CVE-2026-39704
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Missing authorization in the Precious Metals Automated Product Pricing – Pro plugin allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 4.0.5.
Risk Assessment
An attacker could gain unauthorized access to pricing management functions, potentially leading to data manipulation and financial losses.
Recommendation
Update the Precious Metals Automated Product Pricing – Pro plugin to the latest version that includes a fix for the missing authorization.
Original NVD description (English source)
Missing Authorization vulnerability in nfusionsolutions Precious Metals Automated Product Pricing – Pro precious-metals-automated-product-pricing-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Precious Metals Automated Product Pricing – Pro: from n/a through <= 4.0.5.