Is CVE-2026-39669 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39669 being exploited in the wild.

How severe is CVE-2026-39669?

Medium severity, with a CVSS score of 5.3, published 8 April 2026.

Which products and versions are affected?

NitroPack NitroPack through 1.19.3.

Is there a fix for CVE-2026-39669?

A patch was published on 1.19.4: Vulnerability fixed in version 1.19.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39669 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-39669?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39669: NitroPack WordPress plugin missing authorization in access control

CVE-2026-39669 · Severity: medium · CVSS 5.3 · Published 2026-04-08

NitroPack is a popular WordPress plugin used to optimize website speed and performance. A security flaw in the plugin's access control settings could allow unauthorized individuals to bypass intended security levels, potentially leading to the exposure of internal configuration details or restricted information. While the impact is considered moderate, it could be used as a stepping stone for further attacks on the website.

Quick answers

Is CVE-2026-39669 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39669 being exploited in the wild.
How severe is CVE-2026-39669?: Medium severity, with a CVSS score of 5.3, published 8 April 2026.
Which products and versions are affected?: NitroPack NitroPack through 1.19.3.
Is there a fix for CVE-2026-39669?: A patch was published on 1.19.4: Vulnerability fixed in version 1.19.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39669 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-39669?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization (CWE-862) vulnerability exists in the NitroPack plugin for WordPress in versions up to and including 1.19.3. The flaw stems from insufficient validation of access control security levels, which can be exploited by a remote, unauthenticated attacker. By sending specially crafted requests, an attacker can bypass intended restrictions to access functionality or information that should be protected. This issue was addressed in version 1.19.4 by implementing proper authorization checks.

Affected products

NitroPack NitroPack through 1.19.3

Timeline

2026-01-19: other: Vulnerability reported by Steven Julian
2026-02-18: disclosed: Vulnerability details published by Patchstack
2026-04-08: advisory: CVE published to NVD
1.19.4: patched: Vulnerability fixed in version 1.19.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.