CVE-2026-39594

MediumCVSS 6.4

Published: 15/06/2026(UTC)Updated: 15/06/2026(UTC)Translated: 17/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

20th percentile — higher than 20% of all known CVEs

Summary

There is a broken access control issue in Ultra Addons for WPForms versions <= 1.0.11 that may allow unauthorized users to access subscriber resources.

Risk Assessment

Organizations may be exposed to unauthorized access to subscriber data, potentially leading to information leaks and privacy violations.

Recommendation

It is recommended to update Ultra Addons for WPForms to the latest version to mitigate this vulnerability.

Original NVD description (English source)

Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions.