CVE-2026-39776: WordPress Tabs plugin <= 2.5 - Remote Code Execution (RCE) vulnerability
Published Oct 6, 2026
·Updated
Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.
Affected Software
1 affected component
WordPress Tabs plugin<=2.5
Event History
Oct 6, 2026
CVE Published
via MITRE·08:34 AM
Data Sourced
via MITRE·08:34 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an authenticated WordPress account?
Yes. The CVSS vector indicates high privileges are required, so an attacker would need a highly privileged account before exploiting the issue.
2
Is user interaction required for exploitation?
No. The CVSS vector indicates no user interaction is required, although exploitation has high attack complexity and is network-accessible.