PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39686 bannersky CVE debrief

The BSK PDF Manager plugin for WordPress has a vulnerability that allows exposure of sensitive system information to an unauthorized control sphere, potentially enabling retrieval of embedded sensitive data. This issue affects BSK PDF Manager versions from n/a through <= 3.7.2. The vulnerability has been assigned a CVSS score of 5.3 and a severity of MEDIUM. Users should review their deployments and consider updating to a non-vulnerable version. Further investigation and monitoring are recommended due to limited information about the vulnerability and its impact.

Vendor
bannersky
Product
BSK PDF Manager
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Users of BSK PDF Manager plugin for WordPress, especially those with versions from n/a through <= 3.7.2, should be aware of this vulnerability and take necessary actions to mitigate potential risks.

Technical summary

The Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in BSK PDF Manager allows for the retrieval of embedded sensitive data. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. It was published on 2026-04-08T09:16:40.530Z and last modified on 2026-07-24T20:10:00.147Z.

Defensive priority

Medium priority should be given to updating BSK PDF Manager to a version that is not vulnerable, as the current version allows exposure of sensitive system information.

Recommended defensive actions

  • Update BSK PDF Manager to a version beyond 3.7.2 if available.
  • Review and monitor system logs for any suspicious activity related to the plugin.
  • Consider implementing additional security measures such as restricting access to sensitive data.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability. However, detailed information about the vulnerability and its impact is limited. Further investigation and monitoring are recommended.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-08T09:16:40.530Z and has not been modified since.