CVE-2026-39723: WordPress Morning for WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability

Q: Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior access to the affected site.

Q: What security impact is indicated?

The supplied CVSS vector indicates network-reachable exploitation with low attack complexity and no user interaction. It indicates an integrity impact, while confidentiality and availability impacts are listed as none.

Q: Which plugin versions are affected?

Morning for WooCommerce versions 2.4.1 and earlier are identified as affected. The provided data does not identify a fixed version or a workaround.

Published Oct 6, 2026

Updated

Unauthenticated Broken Access Control in Morning for WooCommerce <= 2.4.1 versions.

Affected Software

1 affected component

WordPress Morning for WooCommerce<=2.4.1

Event History

Oct 6, 2026

CVE Published

via MITRE·05:14 AM

Data Sourced

via MITRE·05:14 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior access to the affected site.

What security impact is indicated?

The supplied CVSS vector indicates network-reachable exploitation with low attack complexity and no user interaction. It indicates an integrity impact, while confidentiality and availability impacts are listed as none.

Which plugin versions are affected?