CVE-2026-39610

MediumCVSS 5.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

The WpXmas-Snow plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.1.

Risk Assessment

An unauthorized user can change plugin settings or perform unwanted actions, potentially disrupting website functionality.

Recommendation

It is recommended to update the WpXmas-Snow plugin to the latest version that fixes this vulnerability.

Original NVD description (English source)

Missing Authorization vulnerability in Pankaj Kumar WpXmas-Snow wpxmas-snow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpXmas-Snow: from n/a through <= 1.1.