CVE-2026-39787

MediumCVSS 6.5

Published: 06/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

20th percentile - higher than 20% of all known CVEs

Summary

The vulnerability allows an unauthenticated attacker to exploit Broken Access Control in the 10Web Social Photo Feed plugin in versions up to and including 1.4.35.

Risk Assessment

An unauthenticated attacker can access functions or data they should not have permission to, potentially leading to unauthorized actions.

Recommendation

Update the 10Web Social Photo Feed plugin to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in 10Web Social Photo Feed

CVE-2026-118081High
10Web Social Photo Feed plugin versions up to 1.5.6 contain a Contributor PHP Object Injection vulnerability.

Original NVD description (English source)

Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS