CVE-2026-39650: 
WordPress vulnerability analysis and mitigation

CVE-2026-39650 is a Missing Authorization vulnerability in the Unitech Web UnitechPay WordPress plugin (unitechpay-paiements-mobile-money), classified under CWE-862. It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, affecting all versions through 1.0.2. The vulnerability was disclosed on April 8, 2026, by Patchstack, and carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Patchstack).

The root cause is CWE-862 (Missing Authorization), meaning the plugin fails to perform proper authorization checks before allowing actors to access certain resources or perform actions within the UnitechPay mobile money payment system. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The vulnerability specifically enables exploitation of incorrectly configured access control security levels within the plugin's payment-related functionality (GitHub Advisory, Patchstack).

Successful exploitation could allow unauthenticated attackers to bypass access controls and perform unauthorized actions within the UnitechPay mobile money payment system, including potential transaction manipulation or unauthorized access to payment-related functions. The CVSS assessment indicates a low integrity impact with no confidentiality or availability impact, suggesting the primary risk is unauthorized modification or interaction with payment operations rather than data disclosure or service disruption. The scope is limited to the affected WordPress plugin component (GitHub Advisory, Patchstack).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

Organizations using the UnitechPay WordPress plugin should upgrade to a version greater than 1.0.2 as soon as a patched release becomes available. In the interim, administrators should implement network-level access controls to restrict access to the WordPress installation and review the plugin's access control configurations to ensure proper authorization is enforced for all payment-related functions. Disabling the plugin until a patch is confirmed may also be considered as a precautionary measure (Patchstack, GitHub Advisory).