CVE-2026-39672: 
WordPress vulnerability analysis and mitigation

CVE-2026-39672 is a Missing Authorization vulnerability in the ShipTime: Discounted Shipping Rates WordPress plugin (slug: shiptime-discount-shipping) that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects all versions of the plugin through and including 1.1.1. The vulnerability was disclosed on April 8, 2026, by Patchstack, which serves as the CVE Numbering Authority (CNA). It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before allowing actors to access certain resources or perform actions related to shipping rate management. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote attacker. The vulnerability stems from incorrectly configured access control security levels within the plugin's functionality, allowing unauthorized manipulation of shipping rate features (GitHub Advisory, Patchstack).

Successful exploitation could allow unauthenticated attackers to bypass access control mechanisms and perform unauthorized actions related to shipping rate configurations on affected WordPress sites. This may include unauthorized access to shipping rate data (limited confidentiality impact) or manipulation of discounted shipping rate functionality, potentially enabling rate abuse or unauthorized discounts. Integrity and availability impacts are assessed as none, limiting the overall severity to a medium-level confidentiality concern (GitHub Advisory, Patchstack).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.017% (0.04% per GitHub Advisory), placing it in the 13th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Patchstack).

Organizations using the ShipTime: Discounted Shipping Rates WordPress plugin should immediately upgrade to a version beyond 1.1.1, as a patch has been released to address the missing authorization issue. As an interim measure, administrators should review and audit access control configurations for the plugin and implement role-based access controls to restrict shipping rate management to authorized personnel only. Disabling the plugin until an upgrade can be applied is also a viable risk-reduction step (Patchstack, GitHub Advisory).