What is the CVSS score of CVE-2026-39668?

CVE-2026-39668 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-39668

EUVD-2026-20342 MEDIUM

Missing Authorization (CWE-862)

2026-04-08 Patchstack

GHSA-j4m2-98ph-wgm7

WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20342

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in g5theme Book Previewer for Woocommerce book-previewer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Book Previewer for Woocommerce: from n/a through <= 1.0.6.

AnalysisAI

Book Previewer for WooCommerce plugin versions up to 1.0.6 fail to enforce authorization checks on sensitive functionality, allowing unauthenticated remote attackers to access restricted content with low-complexity exploitation. The vulnerability stems from missing access control validation, enabling attackers to bypass intended security boundaries without user interaction. While CVSS rates this as moderate (5.3), EPSS exploitation probability remains minimal at 0.02% percentile, and no public exploit code or active exploitation has been confirmed.

Technical ContextAI

This is a broken access control vulnerability (CWE-862) in the Book Previewer for WooCommerce WordPress plugin, which integrates with WooCommerce to provide book preview functionality. The plugin fails to implement proper authorization checks on its exposed endpoints or functions, likely in the REST API or AJAX handlers that retrieve or display book preview content. The affected component relies on incorrectly configured access control security levels that do not validate user permissions or capabilities before serving restricted resources. WordPress plugins are vulnerable to this class of issue when they expose functionalities without checking the current user's role or capabilities, allowing both unauthenticated and unprivileged users to perform actions intended only for administrators or paying customers.

RemediationAI

Update Book Previewer for WooCommerce to a patched version beyond 1.0.6 immediately. WordPress plugin updates are available directly from the WordPress admin dashboard (Plugins > Installed Plugins > Book Previewer for WooCommerce > Update) or manually from the WordPress plugin repository at https://wordpress.org/plugins/book-previewer-for-woocommerce/. For detailed vulnerability information and patch confirmation, refer to the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/book-previewer-for-woocommerce/vulnerability/wordpress-book-previewer-for-woocommerce-plugin-1-0-6-broken-access-control-vulnerability. Until patching is completed, site administrators should verify that book preview access is restricted to authorized users at the WooCommerce product/customer level, though this may not fully compensate for plugin-level access control flaws.