First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2026-39599

MediumCVSS 4.3/10Last modified Oct 6, 2026

Description

Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
wallstrdev	WDS MCP Content Manager	<= 3.10.4

References

https://patchstack.com/database/wordpress/plugin/wds-mcp-content-manager/vulnerability/wordpress-wds-mcp-content-manager-plugin-3-10-4-broken-access-control-vulnerability?_s_id=cve

Timeline

Published: Oct 6, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-39609.8A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 CVE-2026-396004.7URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Mehul Gohil Aculect AI Companion aculect-ai-companion allows Phishing.T CVE-2026-396013.7Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar book CVE-2026-396025.3Missing Authorization vulnerability in Rustaurius Order Tracking order-tracking allows Exploiting Incorrectly Configured Access Control Secu CVE-2026-396035.4Cross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Photography grandphotography allows Cross Site Request Forgery.This issu CVE-2026-396045.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookTable Bookstore mybook CVE-2026-396055.3Missing Authorization vulnerability in Obadiah Super Custom Login super-custom-login allows Exploiting Incorrectly Configured Access Control CVE-2026-396065.3Missing Authorization vulnerability in Foysal Imran BizReview bizreview allows Exploiting Incorrectly Configured Access Control Security Lev CVE-2026-396075.4Missing Authorization vulnerability in Wpbens Filter Plus filter-plus allows Exploiting Incorrectly Configured Access Control Security Level CVE-2026-396085.3Missing Authorization vulnerability in iPOSPays iPOSpays Gateways WC ipospays-gateways-wc allows Exploiting Incorrectly Configured Access Co CVE-2026-396095.3Missing Authorization vulnerability in Wava.co Wava Payment wava-payment allows Exploiting Incorrectly Configured Access Control Security Le CVE-2026-39616.3A vulnerability was determined in zyddnys manga-image-translator up to beta-0.3. The affected element is the function to_pil_image of the fi

CVE-2026-39599: Medium severity, CVSS 4.3 | Vulnix