CVE-2026-39639: Unauthorized Access in RPS Include Content
Platform
wordpress
Component
rps-include-content
CVE-2026-39639 describes an unauthorized access vulnerability within the RPS Include Content plugin for WordPress. This flaw allows authenticated users with contributor-level access or higher to execute actions they shouldn't be able to. The vulnerability impacts versions of the plugin up to and including 1.2.2, and a fix is available in later versions.
Detect this CVE in your project
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Impact and Attack Scenarios
The primary impact of CVE-2026-39639 is the potential for unauthorized actions within a WordPress site. An attacker, already logged in with a contributor account (or higher), can leverage this missing capability check to bypass access controls and perform actions typically restricted to administrators or other privileged roles. This could include modifying content, installing plugins, or altering site settings, leading to data compromise, defacement, or even complete site takeover. The blast radius is limited to the scope of actions the contributor account can perform, but the potential for damage is still significant.
Exploitation Context
CVE-2026-39639 was published on 2026-02-14. Its severity is currently assessed as medium. No public proof-of-concept exploits are currently known. The vulnerability is not listed on KEV or EPSS, indicating a low to medium probability of exploitation. Monitor WordPress security forums and vulnerability databases for any updates.
Threat Intelligence
Exploit Status
EPSS
0.03% (8% percentile)
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- Low — any valid user account is sufficient. Basic authenticated access required.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- None — no confidentiality impact. Attacker cannot read protected data.
- Integrity
- Low — attacker can modify some data with limited scope or impact.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
- Modified
- EPSS updated
Mitigation and Workarounds
The primary mitigation for CVE-2026-39639 is to upgrade the RPS Include Content plugin to a version that includes the necessary capability checks. If upgrading immediately is not possible due to compatibility issues or breaking changes, consider restricting contributor access to minimize the potential impact. While a direct WAF rule is unlikely to be effective, carefully reviewing and restricting plugin permissions within WordPress can help reduce the attack surface. After upgrading, verify the fix by attempting to perform an action that would normally require administrator privileges while logged in as a contributor.
How to fix
No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Frequently asked questions
What is CVE-2026-39639 — Unauthorized Access in RPS Include Content?
CVE-2026-39639 is a medium severity vulnerability affecting the RPS Include Content WordPress plugin up to version 1.2.2. It allows authenticated contributors to perform unauthorized actions due to a missing capability check.
Am I affected by CVE-2026-39639 in RPS Include Content?
You are affected if you are using the RPS Include Content plugin in WordPress versions 1.2.2 or earlier. Check your plugin version immediately.
How do I fix CVE-2026-39639 in RPS Include Content?
Upgrade the RPS Include Content plugin to the latest available version, which includes the necessary capability checks to prevent unauthorized access.
Is CVE-2026-39639 being actively exploited?
Currently, there are no known public exploits or active campaigns targeting CVE-2026-39639, but it's crucial to apply the patch proactively.
Where can I find the official RPS Include Content advisory for CVE-2026-39639?
Refer to the official RPS Include Content plugin documentation or the WordPress plugin repository for updates and security advisories related to CVE-2026-39639.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Detect this CVE in your project
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Scan your WordPress project now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...