CVE-2026-39673

MediumCVSS 5.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The iZooto plugin for WordPress (versions up to 3.7.20) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

Risk Assessment

An attacker can gain unauthorized access to push notification functions or data, potentially leading to site security compromise.

Recommendation

Update the iZooto plugin to the latest version that includes a fix for this vulnerability.

Original NVD description (English source)

Missing Authorization vulnerability in shrikantkale iZooto izooto-web-push allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iZooto: from n/a through <= 3.7.20.