CVE-2026-39588 nmerii CVE debrief

Who should care

Administrators of WordPress installations using the NM Gift Registry and Wishlist Lite plugin, especially those with version 5.13 or earlier, should assess and potentially update the plugin to mitigate the vulnerability. Security teams and vulnerability management teams should review the vulnerability and implement compensating controls if necessary.

Technical summary

The CVE-2026-39588 vulnerability has a CVSS score of 5.3 and a MEDIUM severity level. It is caused by a Missing Authorization vulnerability in the NM Gift Registry and Wishlist Lite plugin. The vulnerability allows Exploiting Incorrectly Configured Access Control Security Levels. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. This issue affects the plugin from n/a through version 5.13. There are no known ransomware campaign uses at this time.

Defensive priority

Medium priority for WordPress administrators to review and update the NM Gift Registry and Wishlist Lite plugin.

Recommended defensive actions

• Review and update the NM Gift Registry and Wishlist Lite plugin to a version beyond 5.13 if available.
• Implement additional access controls and monitoring for the plugin.
• Verify plugin configurations and ensure proper authorization settings.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The Patchstack database also has information on this vulnerability. To verify, defenders should review the official CVE record and NVD entry for CVE-2026-39588. The NM Gift Registry and Wishlist Lite plugin for WordPress has a Missing Authorization vulnerability, which allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects the plugin from n/a through version 5.13. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. There are no known ransomware campaign uses at this time.

Official resources