What is the CVSS score of CVE-2026-39659?

CVE-2026-39659 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Ultimate Member CVE-2026-39659

EUVD-2026-20329 MEDIUM

Missing Authorization (CWE-862)

2026-04-08 Patchstack

Authentication Bypass Ultimate Member

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20329

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in Ultimate Member Ultimate Member ultimate-member allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Member: from n/a through <= 2.11.3.

AnalysisAI

Missing authorization in Ultimate Member WordPress plugin versions up to 2.11.3 allows unauthenticated remote attackers to bypass access controls and read sensitive information due to incorrectly configured security levels. The vulnerability has a low CVSS score (5.3) with minimal real-world exploitation risk (EPSS 0.02%), though it enables confidentiality impact through access control circumvention.

Technical ContextAI

Ultimate Member is a WordPress user profile and community plugin that implements role-based access control via configurable security levels. The vulnerability stems from CWE-862 (Missing Authorization), where the plugin fails to properly validate whether a user has authorization to access protected resources or functionality. This is distinct from authentication flaws - the plugin may correctly identify who the user is, but fails to enforce what that user is allowed to do. The affected product is identified via CPE cpe:2.3:a:ultimate_member:ultimate_member:*:*:*:*:*:*:*:*, indicating the entire product line is vulnerable through the specified version range.

RemediationAI

Upgrade Ultimate Member to a version later than 2.11.3. Users should check the official Ultimate Member repository or Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/ultimate-member/vulnerability/wordpress-ultimate-member-plugin-2-11-2-broken-access-control-vulnerability for the specific patched version and installation instructions. As an interim measure, administrators should review and audit access control settings within Ultimate Member to ensure security levels are correctly configured and restrict sensitive content to authenticated users. Additionally, monitor user activity logs for unauthorized access attempts to protected member profiles or functionality.