What is the CVSS score of EUVD-2026-20232?

EUVD-2026-20232 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Order Tracking EUVD-2026-20232

| CVE-2026-39602 MEDIUM

Missing Authorization (CWE-862)

2026-04-08 Patchstack

GHSA-3vcv-mjph-xrqq

Authentication Bypass Order Tracking

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:41 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

5.3 (MEDIUM)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20232

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Missing Authorization vulnerability in Rustaurius Order Tracking order-tracking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Tracking: from n/a through <= 3.4.3.

AnalysisAI

Missing authorization in Rustaurius Order Tracking plugin versions 3.4.3 and below allows unauthenticated remote attackers to modify order data through incorrectly configured access control, enabling unauthorized changes to order information without proper privilege validation. With an EPSS score of 0.02% and no confirmed active exploitation, real-world risk is currently low despite the moderate CVSS score of 5.3.

Technical ContextAI

Rustaurius Order Tracking is a WordPress plugin that manages e-commerce order information. The vulnerability stems from CWE-862 (Missing Authorization), a category where the application fails to properly enforce access control checks on sensitive operations. This occurs when the plugin's order modification endpoints do not validate user privileges before processing requests, allowing attackers to bypass the intended authorization framework. The issue affects the plugin's core order-tracking functionality across all versions through 3.4.3, suggesting the flaw exists in fundamental business logic rather than a specific component.

RemediationAI

Users should upgrade the Rustaurius Order Tracking plugin to version 3.4.4 or later, once released by the vendor with authorization controls restored. Until a patched version is available, site administrators should implement additional access control layers at the web server level (e.g., restricting order modification endpoints to authenticated and role-verified users) or temporarily disable the plugin if order tracking functionality is not critical. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/order-tracking/vulnerability/wordpress-order-tracking-plugin-3-4-3-broken-access-control-vulnerability for vendor-specific guidance and patch release timing.