What is the CVSS score of EUVD-2026-20240?

EUVD-2026-20240 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Filter Plus EUVD-2026-20240

| CVE-2026-39607 MEDIUM

Missing Authorization (CWE-862)

2026-04-08 Patchstack

GHSA-4pf2-mx2w-v6h4

Authentication Bypass Filter Plus

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20240

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

MEDIUM 5.4

DescriptionCVE.org

Missing Authorization vulnerability in Wpbens Filter Plus filter-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Filter Plus: from n/a through <= 1.1.17.

AnalysisAI

Wpbens Filter Plus plugin versions 1.1.17 and earlier allow authenticated users to bypass access controls and modify data they should not have permission to access, due to missing authorization checks on sensitive functionality. An authenticated attacker with low privileges can exploit incorrectly configured access control security levels to read or modify restricted information, impacting the confidentiality and integrity of protected content.

Technical ContextAI

This vulnerability stems from CWE-862 (Missing Authorization), a fundamental access control flaw where the application fails to implement proper authorization checks before allowing sensitive operations. The Wpbens Filter Plus WordPress plugin, identified by CPE cpe:2.3:a:wpbens:filter_plus:*:*:*:*:*:*:*:*, lacks adequate privilege validation on filter configuration endpoints. Rather than enforcing role-based or capability-based restrictions, the plugin allows any authenticated user (PR:L in CVSS vector) to interact with functionality intended for administrators or higher-privilege accounts. This is a server-side authorization failure in a WordPress plugin, where the plugin should verify user capabilities before exposing filter management or configuration endpoints.

RemediationAI

Update the Wpbens Filter Plus plugin to a version newer than 1.1.17 as soon as a patched release becomes available. Site administrators should review the plugin's official repository or vendor advisories for the latest version that addresses this authorization vulnerability. If an immediate update is not available, consider temporarily disabling the Filter Plus plugin or restricting its use to trusted administrators only via WordPress user role management. Verify after patching that access control restrictions are properly enforced by testing with low-privilege user accounts to confirm they cannot access filter configuration endpoints.