CVE-2026-39721
MediumCVSS 5.4Summary
A Missing Authorization vulnerability in Brainstorm Force Starter Templates astra-sites allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Starter Templates from n/a through 4.7.7.
Risk Assessment
Missing authorization may allow unauthorized users to access administrative functions, potentially leading to content modification or site takeover.
Recommendation
It is recommended to update the Starter Templates plugin to the latest version and verify access control configuration.
Other vulnerabilities in Starter Templates
See all- CVE-2026-102393Medium
The Starter Templates plugin (astra-sites) up to version 4.7.7 has a stored Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation.
- CVE-2026-62134Medium
The Starter Templates plugin in versions up to and including 4.7.5 contains an Insecure Direct Object References (IDOR) vulnerability. A user with the Contributor role can access objects they should not have permission to.
Original NVD description (English source)
Missing Authorization vulnerability in Brainstorm Force Starter Templates astra-sites allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Starter Templates: from n/a through 4.7.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS