CVE-2026-39682: 
WordPress vulnerability analysis and mitigation

CVE-2026-39682 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress linkPizza-Manager plugin developed by Arjan Pronk. It affects all versions of the plugin through 5.5.5 and was reported by researcher Nabil Irawan on January 22, 2026, with public disclosure on April 8, 2026. The vulnerability allows unauthenticated network-based attackers to exploit incorrectly configured access control security levels. It carries a CVSS v3.1 base score of 5.3 (Medium), as assessed by both Patchstack and CISA-ADP (Patchstack, GitHub Advisory).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform proper authorization checks when an actor attempts to access a resource or perform an action. An unauthenticated remote attacker can send crafted network requests to exploit misconfigured access control security levels within the plugin, bypassing restrictions that should require elevated privileges. No user interaction or special privileges are required, and attack complexity is low. No detailed technical write-up or proof-of-concept code has been publicly released (Patchstack, GitHub Advisory).

Successful exploitation could allow an unauthenticated attacker to access protected resources or functionality within the linkPizza-Manager plugin that should be restricted to authorized users. The primary impact is a low-level confidentiality breach (unauthorized data access), with no direct integrity or availability impact per the CVSS assessment. Depending on the specific plugin functionality exposed, this could result in unauthorized viewing of link management data or plugin configuration details (Patchstack).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.017% (0.000170), placing it in the 13th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory, Patchstack).

The vulnerability is patched in linkPizza-Manager version 5.6.0. All users running version 5.5.5 or earlier should update to 5.6.0 or later immediately. As an interim measure, restrict access to the WordPress admin panel and the plugin's functionality to trusted users and networks. Patchstack users can enable auto-update for vulnerable plugins to receive protection automatically (Patchstack).

Patchstack, the CNA that reported and disclosed this vulnerability, classified it as low priority with unlikely exploitation impact. No notable researcher commentary, media coverage, or significant community discussion has been observed beyond the standard advisory publications (Patchstack).