CVE-2026-39690

MediumCVSS 5.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The Author Avatars List/Block plugin for WordPress (versions up to 2.1.25) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

Risk Assessment

An attacker can gain unauthorized access to functions or data, potentially leading to site security compromise.

Recommendation

Update the Author Avatars List/Block plugin to the latest version that includes a fix for this vulnerability.

Original NVD description (English source)

Missing Authorization vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Author Avatars List/Block: from n/a through <= 2.1.25.