What is the CVSS score of CVE-2026-39662?

CVE-2026-39662 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Product Price By Formula For Woocommerce CVE-2026-39662

EUVD-2026-20332 MEDIUM

Missing Authorization (CWE-862)

2026-04-08 Patchstack

GHSA-733v-h7xg-5975

WordPress Authentication Bypass Product Price By Formula For Woocommerce Wordpress Plugin

5.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20332

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in ProWCPlugins Product Price by Formula for WooCommerce product-price-by-formula-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Price by Formula for WooCommerce: from n/a through <= 2.5.6.

AnalysisAI

Missing authorization in ProWCPlugins Product Price by Formula for WooCommerce plugin (versions up to 2.5.6) allows unauthenticated remote attackers to read sensitive configuration data through incorrectly configured access control. The vulnerability exposes limited information confidentiality without enabling modification or denial of service, and carries a low real-world exploitation probability (EPSS 0.02%) despite a moderate CVSS score.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization), a flaw in the plugin's access control enforcement mechanism for WooCommerce product configuration. The WordPress plugin fails to properly validate user permissions before exposing API endpoints or configuration pages related to product price formula settings. WordPress plugins are server-side extensions operating within the WooCommerce e-commerce framework, and improper authorization checks allow the plugin to leak configuration details that should require authentication. The affected CPE (cpe:2.3:a:prowcplugins:product_price_by_formula_for_woocommerce:*:*:*:*:*:*:*:*) indicates the entire plugin namespace is in scope, with versions from 0 through 2.5.6 vulnerable.

RemediationAI

Update ProWCPlugins Product Price by Formula for WooCommerce to a patched version later than 2.5.6. Users should check the WordPress plugin repository or Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/product-price-by-formula-for-woocommerce/vulnerability/wordpress-product-price-by-formula-for-woocommerce-plugin-2-5-6-broken-access-control-vulnerability) for the latest available release. Until patching is completed, site administrators should audit access control configurations and consider temporarily disabling the plugin if it is not actively required. WordPress security best practices recommend implementing HTTP authentication or IP whitelisting at the server level to restrict access to product configuration endpoints, though these are defensive measures rather than substitutes for plugin updates.