CVE-2026-39680: 
WordPress vulnerability analysis and mitigation

CVE-2026-39680 is a Missing Authorization (Broken Access Control) vulnerability in the MWP Development Diet Calorie Calculator WordPress plugin. It affects all versions through 1.1.1 and allows unauthenticated network-based attackers to exploit incorrectly configured access control security levels. The vulnerability was reported by researcher Legion Hunter on January 22, 2026, and publicly disclosed on April 8, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Patchstack (Patchstack, GitHub Advisory).

The root cause is CWE-862 (Missing Authorization) — the plugin fails to perform proper authorization checks when an actor attempts to access a resource or perform an action, falling under OWASP Top 10 category A1: Broken Access Control. An unauthenticated remote attacker can send network requests to plugin endpoints that lack proper permission validation, thereby accessing or invoking functionality intended for privileged users. No authentication or user interaction is required, and attack complexity is low. No public technical write-up or proof-of-concept code has been identified (Patchstack, GitHub Advisory).

Successful exploitation allows unauthenticated attackers to bypass access controls and perform unauthorized actions within the Diet Calorie Calculator plugin on affected WordPress sites. The primary impact is a low-level integrity compromise — attackers may manipulate plugin data or invoke restricted functionality without proper permissions. Confidentiality and availability impacts are assessed as none to low, and there is no evidence of lateral movement potential or significant data exposure risk beyond the plugin's own functionality (Patchstack).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.017% (0.000170), placing it in the 13th percentile for exploitation likelihood within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that while vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins, this specific issue is rated low priority with unlikely exploitation impact (GitHub Advisory, Patchstack).

WordPress site administrators should update the Diet Calorie Calculator plugin to a version released after 1.1.1, which addresses the missing authorization checks. If an immediate update is not possible, consider deactivating the plugin until a patch can be applied, or consult your hosting provider for assistance. Additionally, reviewing and strengthening access control configurations within the WordPress installation is recommended as a defense-in-depth measure (Patchstack, GitHub Advisory).