What is the CVSS score of CVE-2026-39714?

CVE-2026-39714 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

G5Plus April CVE-2026-39714

EUVD-2026-20425 MEDIUM

Missing Authorization (CWE-862)

2026-04-08 Patchstack

GHSA-3rjq-96vg-4j89

Authentication Bypass G5Plus April

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20425

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in G5Theme G5Plus April g5plus-april allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects G5Plus April: from n/a through <= 6.8.

AnalysisAI

G5Plus April WordPress theme versions up to 6.8 contain a missing authorization vulnerability allowing unauthenticated remote attackers to access resources with restricted access control levels, resulting in limited information disclosure. The vulnerability affects the theme's broken access control mechanism and has a low exploitation probability (EPSS 0.02%, percentile 4%) with no public exploit identified at time of analysis, though CISA SSVC assessment indicates partial technical impact from non-automatable exploitation.

Technical ContextAI

The vulnerability stems from CWE-862 (Missing Authorization), a fundamental access control weakness where the G5Plus April WordPress theme fails to properly enforce authorization checks on restricted resources. WordPress themes are server-side code that define site presentation and functionality; improper access control in theme code can expose administrative or sensitive content to unauthenticated users. The theme's access control security levels are incorrectly configured, meaning the theme likely lacks proper privilege verification before serving restricted content. This differs from authentication bypass in that users need not assume a valid identity-they simply access resources the theme should restrict based on role or capability.

RemediationAI

Update G5Plus April theme to a patched version released after 6.8 per the Patchstack advisory. WordPress administrators should navigate to Appearance > Themes in the WordPress dashboard, identify G5Plus April, and apply the available update when released. Until patching is available, site administrators should review access control settings and verify that restricted content areas are properly protected through additional WordPress role and capability checks independent of theme-level access control. For detailed remediation guidance, consult the Patchstack vulnerability advisory at https://patchstack.com/database/Wordpress/Theme/g5plus-april/vulnerability/wordpress-g5plus-april-theme-6-8-broken-access-control-vulnerability and the NVD listing at https://nvd.nist.gov/vuln/detail/CVE-2026-39714.