{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39592", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-07T10:48:44.714Z", "datePublished": "2026-04-08T08:30:21.650Z", "dateUpdated": "2026-04-10T16:43:19.891Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "depart-deposit-and-part-payment-for-woo", "product": "DEPART", "vendor": "Andy Ha", "versions": [{"changes": [{"at": "1.0.8", "status": "unaffected"}], "lessThanOrEqual": "1.0.7", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "benzdeus | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-08T10:28:56.024Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Andy Ha DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects DEPART: from n/a through <= 1.0.7.</p>"}], "value": "Missing Authorization vulnerability in Andy Ha DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DEPART: from n/a through <= 1.0.7."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:21.650Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/depart-deposit-and-part-payment-for-woo/vulnerability/wordpress-depart-plugin-1-0-7-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress DEPART plugin <= 1.0.7 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-10T16:43:09.787490Z", "id": "CVE-2026-39592", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T16:43:19.891Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-39592", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T16:43:09.787490Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T16:42:46.313Z"}}], "cna": {"title": "WordPress DEPART plugin <= 1.0.7 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "benzdeus | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "Andy Ha", "product": "DEPART", "versions": [{"status": "affected", "changes": [{"at": "1.0.8", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "1.0.7"}], "packageName": "depart-deposit-and-part-payment-for-woo", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-08T10:28:56.024Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/depart-deposit-and-part-payment-for-woo/vulnerability/wordpress-depart-plugin-1-0-7-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Andy Ha DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DEPART: from n/a through <= 1.0.7.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Andy Ha DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects DEPART: from n/a through <= 1.0.7.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:21.650Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39592", "state": "PUBLISHED", "dateUpdated": "2026-04-10T16:43:19.891Z", "dateReserved": "2026-04-07T10:48:44.714Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-04-08T08:30:21.650Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Andy Ha DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DEPART: from n/a through <= 1.0.7."}], "id": "CVE-2026-39592", "lastModified": "2026-04-10T17:17:10.787", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-04-08T09:16:29.200", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/depart-deposit-and-part-payment-for-woo/vulnerability/wordpress-depart-plugin-1-0-7-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.0.7]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "DEPART", "source": "cna", "vendor": "Andy Ha"}, "product": "depart", "vendor": "andy_ha"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T09:46:27.570087+00:00", "value": {"mitigation_remediation": ["Upgrade the DEPART plugin to the latest available version (any release newer than 1.0.7).", "If an upgrade is not immediately possible, restrict web access to the plugin\u2019s administrative pages using server or WordPress role\u2011based controls."], "summary": {"action": "Immediate Patch", "impact": "Escalated Privileges"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the DEPART plugin by Andy Ha, version 1.0.7 and earlier. All installations of DEPART deployable through WordPress are susceptible until the plugin is updated beyond these earlier releases.", "description_and_impact": "The DEPART plugin contains a missing authorization flaw that permits exploitation of incorrectly configured access control security levels. This allows an attacker to gain unauthorized access to administrative functionalities within the WordPress site, effectively escalating privileges and potentially compromising sensitive data or site operations.", "risk_and_exploitability": "The CVSS score is not supplied, and no EPSS metric is available, but the flaw enables an attacker to bypass normal permission checks. The attack vector is most likely performed remotely over the web, exploiting exposed plugin endpoints. Because the issue has not been marked in the CISA KEV catalog, no publicly-known exploits exist at this time."}}}}, "created": "2026-04-08T19:29:58.702010+00:00", "updated": "2026-04-08T19:42:17.502588+00:00", "vendors": ["andy_ha", "andy_ha$PRODUCT$depart", "wordpress", "wordpress$PRODUCT$wordpress"]}