CVE-2026-39476: 
WordPress vulnerability analysis and mitigation

CVE-2026-39476 is a Missing Authorization (Broken Access Control) vulnerability in the User Feedback WordPress plugin by Syed Balkhi. It affects all versions of the userfeedback-lite plugin through 1.10.1, allowing low-privileged authenticated attackers to exploit misconfigured access control security levels. The vulnerability was reported on February 9, 2026, by researcher Trương Hữu Phúc, disclosed by Patchstack on March 18, 2026, and published to NVD on April 8, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack, NVD).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain privileged actions. An authenticated attacker with Subscriber-level access can send crafted network requests to trigger functionality that should be restricted to higher-privileged roles, exploiting incorrectly configured access control security levels. No complex preconditions are required beyond having a valid low-privileged account on the target WordPress site (Patchstack).

Successful exploitation allows a low-privileged authenticated user (e.g., Subscriber) to access restricted functionality and retrieve sensitive user feedback data that should be limited to administrators. The confidentiality impact is low, with no integrity or availability impact, meaning attackers can read data but cannot modify or disrupt the system. The scope is limited to the affected WordPress installation, with no direct path to lateral movement or full system compromise (Patchstack, NVD).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

The vulnerability is patched in User Feedback plugin version 1.11.0. Site administrators should update the userfeedback-lite plugin to version 1.11.0 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting user registration or limiting Subscriber-level accounts on the site can reduce exposure (Patchstack).