CVE-2026-39672 shiptime CVE debrief

Who should care

Users of ShipTime: Discounted Shipping Rates plugin for WordPress, particularly those responsible for plugin maintenance and security, should verify their installation and update to a patched version if necessary. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and its potential impact on their systems.

Technical summary

The ShipTime: Discounted Shipping Rates plugin for WordPress has a Missing Authorization vulnerability. This issue allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability affects versions from n/a through <= 1.1.1. The CVSS score for this vulnerability is 5.3, indicating a Medium severity level. Users of the plugin should review and adjust access control configurations to prevent exploitation.

Defensive priority

Medium priority due to CVSS score of 5.3 and potential for unauthorized actions.

Recommended defensive actions

• Verify the version of ShipTime: Discounted Shipping Rates plugin and update to a patched version if necessary.
• Review and adjust access control configurations for the plugin.
• Monitor for suspicious activity related to the plugin.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation and verification are necessary to fully understand the impact and potential mitigations. Affected product deployments should be identified and verified for exposure. The vulnerability allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions. Defenders should review access control configurations and monitor for suspicious activity.

Official resources