What is the CVSS score of CVE-2026-39546?

CVE-2026-39546 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Multiloca are affected by CVE-2026-39546?

The TechSpawn MultiLoca WooCommerce plugin (versions 4.2.15 and earlier) contains a privilege escalation vulnerability allowing subscriber-level WordPress users to gain unauthorized administrative…

How to fix or mitigate CVE-2026-39546?

Within 24 hours: Identify all WordPress installations running TechSpawn MultiLoca and document current plugin versions. Within 7 days: Audit subscriber user accounts on affected systems; restrict subscriber account creation and remove unnecessary accounts if feasible; enable comprehensive admin action logging. Within 30 days: Contact Patchstack and vendor for patch timeline; evaluate alternative e-commerce inventory plugins; prepare upgrade or migration plan if vendor does not release a patch.

Multiloca CVE-2026-39546

EUVD-2026-37674 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-06-17 Patchstack

WordPress Privilege Escalation Multiloca Wordpress Plugin Techspawn

7.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:23 vuln.today

DescriptionCVE.org

Subscriber Privilege Escalation in MultiLoca <= 4.2.15 versions.

AnalysisAI

Privilege escalation in TechSpawn MultiLoca (WooCommerce Multi Locations Inventory Management) plugin versions 4.2.15 and earlier allows authenticated subscriber-level users to elevate their privileges within affected WordPress sites. The flaw, classified under CWE-266 (Incorrect Privilege Assignment), carries a CVSS 7.6 score with no public exploit identified at time of analysis. The vulnerability was disclosed via Patchstack and affects WordPress installations running the plugin for WooCommerce multi-location inventory management.