{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39682", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-07T10:58:05.155Z", "datePublished": "2026-04-08T08:30:41.356Z", "dateUpdated": "2026-04-08T15:06:59.550Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "linkpizza-manager", "product": "linkPizza-Manager", "vendor": "Arjan Pronk", "versions": [{"lessThanOrEqual": "5.5.5", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-08T10:28:42.309Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Arjan Pronk linkPizza-Manager linkpizza-manager allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects linkPizza-Manager: from n/a through <= 5.5.5.</p>"}], "value": "Missing Authorization vulnerability in Arjan Pronk linkPizza-Manager linkpizza-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects linkPizza-Manager: from n/a through <= 5.5.5."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:41.356Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/linkpizza-manager/vulnerability/wordpress-linkpizza-manager-plugin-5-5-5-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress linkPizza-Manager plugin <= 5.5.5 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T15:06:53.565190Z", "id": "CVE-2026-39682", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T15:06:59.550Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-39682", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T15:06:53.565190Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T15:06:32.832Z"}}], "cna": {"title": "WordPress linkPizza-Manager plugin <= 5.5.5 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "Arjan Pronk", "product": "linkPizza-Manager", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "5.5.5"}], "packageName": "linkpizza-manager", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-08T10:28:42.309Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/linkpizza-manager/vulnerability/wordpress-linkpizza-manager-plugin-5-5-5-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Arjan Pronk linkPizza-Manager linkpizza-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects linkPizza-Manager: from n/a through <= 5.5.5.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Arjan Pronk linkPizza-Manager linkpizza-manager allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects linkPizza-Manager: from n/a through <= 5.5.5.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:41.356Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39682", "state": "PUBLISHED", "dateUpdated": "2026-04-08T15:06:59.550Z", "dateReserved": "2026-04-07T10:58:05.155Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-04-08T08:30:41.356Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Arjan Pronk linkPizza-Manager linkpizza-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects linkPizza-Manager: from n/a through <= 5.5.5."}], "id": "CVE-2026-39682", "lastModified": "2026-04-08T21:26:13.410", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-04-08T09:16:40.003", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/linkpizza-manager/vulnerability/wordpress-linkpizza-manager-plugin-5-5-5-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.5.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "linkPizza-Manager", "source": "cna", "vendor": "Arjan Pronk"}, "product": "linkpizza-manager", "vendor": "arjan_pronk"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T16:26:14.021832+00:00", "value": {"mitigation_remediation": ["Update the linkPizza\u2011Manager plugin to the latest released version (5.5.6 or newer).", "If an update is not immediately available, deactivate or uninstall the plugin until a patch is released.", "Verify that all other plugins and WordPress core are updated to the latest stable releases.", "Monitor site logs for any unauthorized or anomalous activity related to the plugin\u2019s functionality."], "summary": {"action": "Patch Immediately", "impact": "Unauthorized Access to privileged actions"}, "threat_synthesis": {"affected_systems": "The issue impacts the linkPizza\u2011Manager plugin distributed by Arjan Pronk for WordPress platforms. All installations of the plugin with versions up to and including 5.5.5 are affected. No other WordPress plugins or core software are listed as affected.", "description_and_impact": "This vulnerability is a missing authorization flaw in the Arjan Pronk linkPizza\u2011Manager WordPress plugin that allows an attacker to exploit incorrectly configured access control security levels. Because the plugin does not validate user permissions properly, an attacker can invoke administrative or protected functionality intended only for authorized users. The consequence is that data or settings managed by the plugin could be read, altered, or deleted, compromising the integrity and confidentiality of the site content.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% reflects a low probability of exploitation in the wild, and the vulnerability is not present in the CISA KEV list. Based on the description, it is inferred that the attack vector is through the web interface of the affected plugin, where a user\u2014authenticated or potentially unauthenticated\u2014could trigger privileged operations without proper checks. The exploit would require basic knowledge of the plugin\u2019s administrative URLs or form submissions, making it relatively easy to conduct in a susceptible environment."}}}}, "created": "2026-04-08T19:27:51.652647+00:00", "updated": "2026-04-08T19:40:38.913396+00:00", "vendors": ["arjan_pronk", "arjan_pronk$PRODUCT$linkpizza-manager", "wordpress", "wordpress$PRODUCT$wordpress"]}