Fox CVE-2026-39501

This vulnerability presents a moderate but low-priority risk profile. While the CVSS score of 5.3 (Medium) with network attack vector and no privilege requirement indicates a readily exploitable flaw, multiple signals suggest limited real-world danger: the EPSS exploitation probability is extremely low at 0.02% (4th percentile), indicating security researchers assess minimal likelihood of active exploitation; the confidentiality impact is limited (C:L) rather than severe; and no KEV confirmation or public proof-of-concept is noted in available data. The authorization bypass is genuine and warrants remediation, but prioritization should account for the negligible EPSS score-this appears a correctly-configured but moderately-valued vulnerability rather than a critical real-world threat. For WordPress site operators, remediation is straightforward and recommended but not emergency-level.

An unauthenticated attacker could craft a network request to the vulnerable FOX plugin endpoint without providing authentication credentials. Due to the missing authorization check, the plugin would process the request and return limited sensitive data (such as currency configuration, pricing information, or user preferences) that should have been restricted. The low attack complexity (AC:L) means no special conditions or timing are required, allowing opportunistic exploitation through automated scanning or manual web reconnaissance of WordPress sites running the affected plugin versions.