Is CVE-2026-39477 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39477 being exploited in the wild.

How severe is CVE-2026-39477?

Medium severity, with a CVSS score of 4.3, published 8 April 2026.

Which products and versions are affected?

Brainstorm Force CartFlows <= 2.2.3.

Is there a fix for CVE-2026-39477?

A patch was published on 2026-04-08: Version 2.2.4 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39477 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-39477?

Check whether you run Brainstorm Force CartFlows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39477: Brainstorm Force CartFlows missing authorization in WordPress plugin

Q: Is there a fix for CVE-2026-39477?

A patch was published on 2026-04-08: Version 2.2.4 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-39477 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-39477?

Check whether you run Brainstorm Force CartFlows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39477 · Severity: medium · CVSS 4.3 · Published 2026-04-08

CartFlows is a popular WordPress plugin used to create sales funnels and checkout experiences for e-commerce sites. A security flaw in versions 2.2.3 and earlier allows users with low-level access (such as contributors) to bypass intended security restrictions. This could lead to unauthorized access to certain administrative functions or data, potentially compromising the integrity of the sales funnel configuration.

Technologies: Brainstorm Force CartFlows. Vendors: Brainstorm Force.

Quick answers

Is CVE-2026-39477 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39477 being exploited in the wild.
How severe is CVE-2026-39477?: Medium severity, with a CVSS score of 4.3, published 8 April 2026.
Which products and versions are affected?: Brainstorm Force CartFlows <= 2.2.3.
Is there a fix for CVE-2026-39477?: A patch was published on 2026-04-08: Version 2.2.4 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39477 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-39477?: Check whether you run Brainstorm Force CartFlows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Broken Access Control (Missing Authorization) vulnerability exists in the Brainstorm Force CartFlows plugin for WordPress. The flaw, classified as CWE-862, stems from insufficient validation of user permissions within certain plugin functions. An attacker authenticated with 'Contributor' or higher privileges can exploit this over the network without user interaction to perform actions or access data they are not authorized to reach. The issue is resolved in version 2.2.4, which introduces proper authorization checks.

Affected products

Brainstorm Force CartFlows <= 2.2.3

Timeline

2026-02-25: other: Vulnerability reported by researcher
2026-03-27: advisory: Patchstack published initial advisory
2026-04-08: disclosed: CVE published to NVD
2026-04-08: patched: Version 2.2.4 released to address the issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.