CVE-2026-39528: 
WordPress vulnerability analysis and mitigation

CVE-2026-39528 is a Missing Authorization (Broken Access Control) vulnerability in the WP Delicious WordPress plugin (also known as delicious-recipes) that allows unauthenticated remote attackers to exploit incorrectly configured access control security levels. It affects all versions of WP Delicious through 1.9.5, with version 1.9.6 containing the fix. The vulnerability was reported by researcher 'hhhai' on January 26, 2026, and published by Patchstack on February 25, 2026, with CVE assignment on April 8, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain privileged actions. This allows unauthenticated network-based attackers to invoke functionality that should be restricted to higher-privileged users, exploiting incorrectly configured access control security levels. No authentication, user interaction, or special conditions are required for exploitation, as the attack vector is network-accessible with low complexity (Patchstack).

Successful exploitation results in a limited confidentiality impact, allowing unauthenticated attackers to access information or perform actions beyond their intended privilege level within the WP Delicious plugin. There is no direct integrity or availability impact based on the CVSS assessment. While the individual impact is rated low severity, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or popularity (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with unlikely exploitation, though the unauthenticated attack vector and zero required privileges make it technically accessible to any remote attacker (Patchstack).

The primary remediation is to update the WP Delicious plugin to version 1.9.6 or later, which contains the fix for this broken access control issue. Site administrators using Patchstack can enable auto-update for vulnerable plugins to receive protection automatically. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance (Patchstack).