Tabs Responsive CVE-2026-39776

Requires an authenticated WordPress account with elevated privileges (PR:H - consistent with the 'Editor' role named in the title) that can access the Tabs plugin's content/editing functionality on a site running Tabs/Tabs Responsive version 2.5 or earlier. Exploitation further depends on high-complexity conditions (AC:H), indicating the attacker must satisfy specific payload or application-state requirements rather than firing a single trivial request. Limiting factors: the privileged-role prerequisite means default single-administrator sites with no untrusted editor accounts are not remotely exploitable by anonymous attackers; risk concentrates on multi-user sites that delegate editor/author roles. No end-user interaction is required once the privileged session exists.

This is a high-severity (CVSS 8.0) code injection flaw (CWE-94) in the WPShopmart 'Tabs'/'Tabs Responsive' WordPress plugin (versions <= 2.5), reported by Patchstack. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H tempers the raw score considerably: while the attack is network-based (AV:N) and needs no user interaction (UI:N), it requires HIGH privileges (PR:H) and HIGH attack complexity (AC:H), meaning the attacker must already hold an elevated, authenticated role and overcome non-trivial conditions. The naming 'Editor Remote Code Execution' and PR:H together indicate a privileged contributor/editor/author-level account is the realistic precondition, reclassifying this from a mass-exploitable perimeter bug to a privilege-escalation / post-authentication RCE. The scope change (S:C) plus full C/I/A impact reflects that successful exploitation yields code execution escaping the plugin's security context to the underlying host/site. No EPSS score, CISA KEV listing, or public POC was provided in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' In priority terms this is a genuine but conditional risk - dangerous where untrusted users hold editor-class roles (multi-author sites, membership platforms), but low urgency for single-admin installations. The main uncertainty is the exact minimum role required, which the input does not pin down beyond the PR:H signal and the 'Editor' label.

An attacker who has obtained or been granted an editor/author-level WordPress account (e.g., on a multi-author blog, membership site, or via a compromised contributor credential) submits crafted content through the vulnerable Tabs plugin interface, causing attacker-controlled PHP/code to be injected and executed on the server. Because UI:N and AV:N apply, no victim interaction is needed once the privileged session is active, but the high complexity (AC:H) suggests specific payload or state conditions must be met. No public proof-of-concept was referenced in the provided data.