WP Dummy Content Generator CVE-2026-39763

Exploitation requires an authenticated session on the target WordPress site: the CVSS vector specifies PR:L, so the attacker must hold at least a low-privilege account (e.g., subscriber/contributor) rather than being fully unauthenticated. The vulnerability stems from the plugin failing to enforce an authorization/capability check (CWE-862, broken access control) on one or more of its actions in WP Dummy Content Generator versions up to and including 4.0.0. Limiting factors: the site must have this specific plugin installed and active, the attacker needs valid credentials for a registrable low-privilege role (so sites that disable open registration raise the bar), no user interaction is required (UI:N), and the impact is confined to limited integrity (C:N/I:L/A:N) - no data disclosure or denial of service.

This is a low-to-moderate priority issue, not a high-severity emergency. The CVSS 3.1 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, meaning network-reachable and low-complexity but requiring at least low-level authenticated privileges (PR:L) and yielding only a limited integrity impact with no confidentiality or availability consequence. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The signals are internally consistent: a broken-access-control (CWE-862) flaw in a minor WordPress utility plugin, reported by Patchstack, with modest impact. The realistic risk is that an authenticated low-privilege user (e.g., a subscriber or contributor) could perform an action they should not be authorized for, affecting data integrity in a limited way. There is no conflicting data, but note that EPSS and any POC status are simply absent rather than confirmed-negative.

An attacker who already holds a low-privilege authenticated account (such as a subscriber) on a WordPress site running WP Dummy Content Generator ≤4.0.0 sends a request to a plugin endpoint that fails to verify the caller's authorization. Because the missing authorization check is network-reachable and low-complexity, the attacker can invoke privileged plugin functionality to modify content or settings they should not control. No public exploit code is identified at time of analysis, and the impact is limited to integrity (C:N/I:L/A:N).