Is CVE-2026-39602 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39602 being exploited in the wild.

How severe is CVE-2026-39602?

Medium severity, with a CVSS score of 5.3, published 8 April 2026.

Which products and versions are affected?

Etoile Web Design Order Tracking <= 3.4.3.

Is there a fix for CVE-2026-39602?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-39602 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-39602?

Check whether you run Etoile Web Design Order Tracking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39602: Rustaurius Order Tracking missing authorization in order-tracking

Q: Is there a fix for CVE-2026-39602?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-39602 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-39602?

Check whether you run Etoile Web Design Order Tracking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39602 · Severity: medium · CVSS 5.3 · Published 2026-04-08

The Order Tracking plugin for WordPress, which allows customers to track the status of their orders, contains a security flaw in its access control settings. An unauthorized user could potentially bypass security levels to perform actions they should not be allowed to do, such as modifying order information. This could lead to data integrity issues and disruption of customer service operations.

Vendors: Etoile Web Design.

Quick answers

Is CVE-2026-39602 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39602 being exploited in the wild.
How severe is CVE-2026-39602?: Medium severity, with a CVSS score of 5.3, published 8 April 2026.
Which products and versions are affected?: Etoile Web Design Order Tracking <= 3.4.3.
Is there a fix for CVE-2026-39602?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-39602 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-39602?: Check whether you run Etoile Web Design Order Tracking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Broken Access Control vulnerability (CWE-862) exists in the Rustaurius Order Tracking plugin (order-tracking) for WordPress through version 3.4.3. The flaw stems from missing authorization checks or incorrectly configured security levels within the plugin's order-tracking functions. An unauthenticated remote attacker can exploit this vulnerability to execute actions that should be restricted to higher-privileged users. While the CVSS score indicates a partial impact on integrity, the vulnerability allows for unauthorized manipulation of plugin-managed data. No official patch was noted in the primary advisory, though users are advised to monitor for updates beyond version 3.4.3.

Affected products

Rustaurius (Etoile Web Design) Order Tracking <= 3.4.3

Timeline

2026-01-01: other: Vulnerability reported by researcher Jakub Herman
2026-01-31: disclosed: Initial disclosure by Patchstack
2026-04-08: advisory: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.