Is CVE-2026-39569 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39569 being exploited in the wild.

How severe is CVE-2026-39569?

Medium severity, with a CVSS score of 6.5, published 8 April 2026.

Which products and versions are affected?

Code4Recovery 12 Step Meeting List <= 3.19.9.

Is there a fix for CVE-2026-39569?

A patch was published on 2026-03-22: Patch released in version 3.19.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39569 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-39569?

Check whether you run Code4Recovery 12 Step Meeting List at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39569: AA Web Servant 12 Step Meeting List missing authorization

Q: Is there a fix for CVE-2026-39569?

A patch was published on 2026-03-22: Patch released in version 3.19.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-39569 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-39569?

Check whether you run Code4Recovery 12 Step Meeting List at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39569 · Severity: medium · CVSS 6.5 · Published 2026-04-08

The 12 Step Meeting List plugin for WordPress, which helps organizations manage and display recovery meeting schedules, contains a security flaw in its access control settings. This vulnerability allows logged-in users with low-level permissions to bypass security restrictions and potentially access sensitive information they should not be able to see. Organizations using this plugin should update to the latest version to ensure their meeting data and administrative configurations remain secure.

Technologies: Code4Recovery 12 Step Meeting List. Vendors: Code4Recovery.

Quick answers

Is CVE-2026-39569 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39569 being exploited in the wild.
How severe is CVE-2026-39569?: Medium severity, with a CVSS score of 6.5, published 8 April 2026.
Which products and versions are affected?: Code4Recovery 12 Step Meeting List <= 3.19.9.
Is there a fix for CVE-2026-39569?: A patch was published on 2026-03-22: Patch released in version 3.19.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39569 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-39569?: Check whether you run Code4Recovery 12 Step Meeting List at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization (CWE-862) vulnerability exists in the AA Web Servant 12 Step Meeting List plugin for WordPress in versions up to and including 3.19.9. The flaw stems from incorrectly configured access control security levels, which fail to properly validate user permissions before granting access to certain functions or data. An attacker authenticated with 'Contributor' level privileges can exploit this over the network to gain unauthorized access to information (Impact: Confidentiality High). The issue is resolved in version 3.19.10.

Affected products

AA Web Servant 12 Step Meeting List <= 3.19.9

Timeline

2026-02-20: other: Reported by Bao - BlueRock
2026-03-22: patched: Patch released in version 3.19.10
2026-04-08: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.