CVE-2026-39691: 
WordPress vulnerability analysis and mitigation

CVE-2026-39691 is a Missing Authorization (Broken Access Control) vulnerability in the AdAstraCrypto "Cryptocurrency Donation Box – Bitcoin & Crypto Donations" WordPress plugin. It affects all versions through 2.2.13 and allows unauthenticated remote attackers to exploit incorrectly configured access control security levels. The vulnerability was reported by Nabil Irawan on January 24, 2026, and publicly disclosed by Patchstack on February 23, 2026, with NVD publication on April 8, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack, GitHub Advisory).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks when an actor attempts to access a resource or perform an action. This allows unauthenticated users to invoke privileged plugin functions — such as those managing donation settings or configurations — without proper access control enforcement. The attack vector is network-based, requires no privileges or user interaction, and has low attack complexity, making it straightforward to exploit. No specific technical write-up or proof-of-concept code has been publicly released (Patchstack, GitHub Advisory).

Successful exploitation allows unauthorized users to access, modify, or manipulate donation-related functions and data within the plugin that should be restricted to privileged users. The primary impact is on integrity (rated Low), with no direct confidentiality or availability impact per the CVSS scoring. In practice, an attacker could alter donation wallet addresses or plugin settings, potentially redirecting cryptocurrency donations to attacker-controlled addresses (Patchstack, GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.017% (0.04% per GitHub Advisory), placing it in the 12th percentile for exploitation likelihood within the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited despite the vulnerability class being associated with mass-exploit campaigns (Patchstack, GitHub Advisory).

Users should update the Cryptocurrency Donation Box – Bitcoin & Crypto Donations WordPress plugin to a version newer than 2.2.13. At the time of the Patchstack disclosure, no official patched version was listed, so site administrators should monitor the plugin's WordPress.org page for an updated release and apply it promptly. As an interim measure, consider disabling the plugin until a patched version is available, or use a web application firewall (WAF) solution such as Patchstack to virtually patch the vulnerability (Patchstack, GitHub Advisory).