PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39686 bannersky CVE debrief

The BSK PDF Manager plugin for WordPress has a vulnerability that allows exposure of sensitive system information to an unauthorized control sphere, potentially enabling retrieval of embedded sensitive data. This issue affects BSK PDF Manager versions from n/a through <= 3.7.2. The vulnerability has been assigned a CVSS score of 5.3 and a severity of MEDIUM. Users should review their deployments and consider updating to a non-vulnerable version. Further investigation and monitoring are recommended due to limited information about the vulnerability and its impact.

Vendor
bannersky
Product
BSK PDF Manager
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Users of BSK PDF Manager plugin for WordPress, especially those with versions from n/a through <= 3.7.2, should be aware of this vulnerability and take necessary actions to mitigate potential risks.

Technical summary

The Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in BSK PDF Manager allows for the retrieval of embedded sensitive data. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. It was published on 2026-04-08T09:16:40.530Z and last modified on 2026-07-24T20:10:00.147Z.

Defensive priority

Medium priority should be given to updating BSK PDF Manager to a version that is not vulnerable, as the current version allows exposure of sensitive system information.

Recommended defensive actions

  • Update BSK PDF Manager to a version beyond 3.7.2 if available.
  • Review and monitor system logs for any suspicious activity related to the plugin.
  • Consider implementing additional security measures such as restricting access to sensitive data.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability. However, detailed information about the vulnerability and its impact is limited. Further investigation and monitoring are recommended.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-39686 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-39686

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-39686 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-39686

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.