What is the CVSS score of CVE-2026-39709?

CVE-2026-39709 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

The Tribal CVE-2026-39709

EUVD-2026-20416 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-04-08 Patchstack

GHSA-q393-qcvf-86q5

Information Disclosure The Tribal

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:44 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

5.3 (MEDIUM)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20416

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Insertion of Sensitive Information Into Sent Data vulnerability in thetechtribe The Tribal the-tech-tribe allows Retrieve Embedded Sensitive Data.This issue affects The Tribal: from n/a through <= 1.3.4.

AnalysisAI

The Tribal WordPress plugin through version 1.3.4 exposes sensitive data in outbound network communications, allowing unauthenticated remote attackers to retrieve embedded sensitive information with low complexity. The vulnerability stems from improper handling of sensitive data before transmission, classified as CWE-201 (Insertion of Sensitive Information Into Sent Data). With an EPSS score of 0.02% and no confirmed active exploitation, this represents a low real-world priority despite the network-accessible attack vector, suggesting the exposure may require specific conditions or have limited practical exploitability.

Technical ContextAI

The Tribal is a WordPress plugin (CPE: cpe:2.3:a:thetechtribe:the_tribal:*:*:*:*:*:*:*:*) that fails to properly sanitize or encrypt sensitive data before including it in outgoing HTTP requests or responses. CWE-201 describes the insertion of sensitive information (such as credentials, tokens, or private identifiers) into data sent over a network without adequate protection mechanisms. This is a common issue in WordPress plugins where developers inadvertently log, transmit, or embed confidential information in API calls, webhooks, form submissions, or debug output. The vulnerability affects all versions from the first release through 1.3.4, indicating it was never properly mitigated during the plugin's development lifecycle.

RemediationAI

Update The Tribal WordPress plugin to version 1.3.5 or later if available from the vendor; check the official WordPress plugin repository or thetechtribe's website for the patched release. If an immediate patch is unavailable, review and restrict network access to the plugin's functionality, disable the plugin if not critical to operations, or implement application-layer monitoring to detect outbound transmission of sensitive data. Consult the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-39709 for any supplementary guidance or workarounds specific to your deployment.