CVE-2026-39600 Mehul Gohil CVE debrief

Who should care

WordPress administrators and users of the Aculect AI Companion plugin should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

CVE-2026-39600 is a medium-severity vulnerability in the WordPress Aculect AI Companion plugin that allows for Unvalidated Redirects and Forwards, potentially enabling phishing attacks. WordPress administrators and users of the plugin should assess their exposure and take necessary actions to mitigate the vulnerability.

• Phishing attacks may be possible due to the Unvalidated Redirects and Forwards vulnerability.
• Defenders should verify the presence of this vulnerability in their WordPress installations.
• Updating to a patched version of Aculect AI Companion may be necessary to mitigate the vulnerability.

Technical summary

The Aculect AI Companion plugin for WordPress is vulnerable to Unvalidated Redirects and Forwards, potentially allowing phishing attacks. The issue affects versions up to and including 0.8.2. This vulnerability could allow attackers to redirect users to malicious sites, leading to potential phishing attacks. The plugin's vulnerability is due to a lack of proper validation of redirects, which could be exploited by attackers to trick users into visiting malicious sites.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and updating to a patched version if available.

Recommended defensive actions

• Verify the presence of Aculect AI Companion version 0.8.2 or earlier in your WordPress installation.
• Update to a patched version of Aculect AI Companion if available.
• Monitor for potential phishing attacks targeting your WordPress users.

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information on exploitation or impact is limited. There is no evidence of public exploitation, but defenders should verify the presence of Aculect AI Companion version 0.8.2 or earlier in their WordPress installation. The source-provided information indicates that the vulnerability affects versions up to and including 0.8.2, but further details on the vulnerability's impact are not available. Defenders

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.