What is the CVSS score of CVE-2026-39595?

CVE-2026-39595 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

W3 Total Cache CVE-2026-39595

EUVD-2026-37588 MEDIUM

Missing Authorization (CWE-862)

2026-06-17 Patchstack

Authentication Bypass W3 Total Cache

4.7

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.7 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

4.7 MEDIUM

Network-accessible WordPress endpoint; Author-level session required (PR:H); low, bounded CIA impact with no scope change to other systems.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:54 vuln.today

DescriptionCVE.org

Author Broken Access Control in W3 Total Cache <= 2.9.1 versions.

AnalysisAI

W3 Total Cache for WordPress (versions through 2.9.1) exposes Author-role users to administrative plugin functions due to missing authorization checks (CWE-862), enabling unintended read, write, and availability impacts against the caching layer. The CVSS vector confirms a network-accessible, low-complexity exploit requiring Author-level authentication (PR:H), with low but confirmed impact across all three CIA dimensions. No public exploit code or active exploitation via CISA KEV has been identified at the time of analysis.

Technical ContextAI

W3 Total Cache (CPE: cpe:2.3:a:boldgrid:w3_total_cache:*:*:*:*:*:*:*:*) is a widely-deployed WordPress caching plugin by BoldGrid that manages page, object, database, and CDN caching. CWE-862 (Missing Authorization) indicates that one or more plugin endpoints or AJAX actions perform a capability check insufficient to restrict access to users holding the WordPress 'Author' role - a role granted to content creators who should have no access to plugin configuration or cache management. WordPress plugins commonly register admin-page callbacks or REST/AJAX hooks and rely on current_user_can() checks; when those checks are absent or mapped to a capability available to Authors, lower-privileged authenticated users gain control over functions intended for Administrators. The 'Authentication Bypass' tag from Patchstack corroborates that the flaw allows circumventing the intended role boundary, not just performing privileged operations with valid credentials.

RemediationAI

Update W3 Total Cache to a version later than 2.9.1 once a patched release is published by BoldGrid. No exact fixed version number was confirmed in the available source data - check the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/w3-total-cache/vulnerability/wordpress-w3-total-cache-plugin-2-9-1-broken-access-control-vulnerability?_s_id=cve for the confirmed release. As an interim compensating control, restrict the Author role to trusted internal users only and remove or demote any external or semi-trusted Author accounts until a patch is applied - this directly removes the prerequisite privilege required for exploitation. Alternatively, disable the W3 Total Cache plugin temporarily if Author-role contributors are numerous and untrusted; disabling caching will degrade performance but eliminates the attack surface. Do not rely on security-through-obscurity measures such as obscuring admin URLs, as the plugin's AJAX or REST hooks are typically discoverable.