CVE-2026-39588: 
WordPress vulnerability analysis and mitigation

CVE-2026-39588 is a Missing Authorization (Broken Access Control) vulnerability in the NM Gift Registry and Wishlist Lite WordPress plugin developed by nmerii. It affects all versions up to and including 5.13, and was reported by researcher Legion Hunter on January 19, 2026, with public disclosure on April 8, 2026. The vulnerability was assigned a CVSS v3.1 base score of 5.3 (Medium) by CISA-ADP, reflecting a network-exploitable, unauthenticated flaw with limited integrity impact (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain privileged actions. This allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, potentially performing actions reserved for higher-privileged users. No authentication, user interaction, or special conditions are required for exploitation, as the attack vector is network-accessible with low complexity (Patchstack).

Successful exploitation results in a limited integrity impact — unauthenticated attackers can perform unauthorized actions within the plugin's functionality, such as manipulating gift registry or wishlist data. There is no confidentiality or availability impact based on the CVSS assessment. The scope is limited to the affected WordPress plugin and does not directly enable lateral movement or system-level compromise, though mass-exploit campaigns targeting WordPress plugins of this type are common (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites indiscriminately (Patchstack).

The vendor has released version 5.14 of the NM Gift Registry and Wishlist Lite plugin, which resolves this vulnerability. Site administrators should update to version 5.14 or later immediately via the WordPress plugin dashboard. If an immediate update is not possible, consider temporarily deactivating the plugin or consulting your hosting provider. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).