{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39705", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-07T10:58:22.476Z", "datePublished": "2026-04-08T08:30:47.550Z", "dateUpdated": "2026-04-08T08:30:47.550Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "mipl-wc-multisite-sync", "product": "MIPL WC Multisite Sync", "vendor": "Mulika Team", "versions": [{"lessThanOrEqual": "1.4.4", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Legion Hunter | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-08T10:28:43.918Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Mulika Team MIPL WC Multisite Sync mipl-wc-multisite-sync allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects MIPL WC Multisite Sync: from n/a through <= 1.4.4.</p>"}], "value": "Missing Authorization vulnerability in Mulika Team MIPL WC Multisite Sync mipl-wc-multisite-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MIPL WC Multisite Sync: from n/a through <= 1.4.4."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:47.550Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/mipl-wc-multisite-sync/vulnerability/wordpress-mipl-wc-multisite-sync-plugin-1-4-4-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress MIPL WC Multisite Sync plugin <= 1.4.4 - Broken Access Control vulnerability"}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Mulika Team MIPL WC Multisite Sync mipl-wc-multisite-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MIPL WC Multisite Sync: from n/a through <= 1.4.4."}], "id": "CVE-2026-39705", "lastModified": "2026-04-08T21:26:13.410", "metrics": {}, "published": "2026-04-08T09:16:43.230", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/mipl-wc-multisite-sync/vulnerability/wordpress-mipl-wc-multisite-sync-plugin-1-4-4-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.4.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MIPL WC Multisite Sync", "source": "cna", "vendor": "Mulika Team"}, "product": "mipl_wc_multisite_sync", "vendor": "mulika_team"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T10:42:43.165879+00:00", "value": {"mitigation_remediation": ["Contact the plugin developer or consult the vendor\u2019s security advisories to confirm a patch is available.", "When a patched version is released, upgrade the MIPL WC Multisite Sync plugin to the latest build.", "If an update cannot be applied immediately, disable the plugin or restrict access to the WordPress admin area for users who do not need bulk sync functionality.", "Monitor the site for unusual sync activity or configuration changes that could indicate exploitation attempts."], "summary": {"action": "Update", "impact": "unauthorized access to multisite sync functions"}, "threat_synthesis": {"affected_systems": "WordPress sites that have the MIPL WC Multisite Sync plugin installed and are running version 1.4.4 or earlier are affected. Any site using these versions is potentially vulnerable.", "description_and_impact": "A missing authorization check in the Mulika Team MIPL WC Multisite Sync WordPress plugin allows an attacker to exercise functionality that should be limited to privileged users, such as synchronizing data across sites or altering plugin settings. This can lead to unauthorized data manipulation or privilege escalation if other vulnerabilities are present.", "risk_and_exploitability": "The CVSS score is not disclosed and EPSS data is unavailable, indicating no current public exploitation reports. The likely attack vector is via unauthenticated or insufficiently authenticated web requests to the plugin\u2019s administrative endpoints where the access control check is omitted. The vulnerability exploits a missing authorization control, so it requires the attacker to reach the plugin\u2019s endpoints; the complexity and effort are moderate, and the potential impact includes unauthorized data handling and possible escalation in the site\u2019s ecosystem."}}}}, "created": "2026-04-08T19:27:29.713583+00:00", "updated": "2026-04-08T19:40:13.861688+00:00", "vendors": ["mulika_team", "mulika_team$PRODUCT$mipl_wc_multisite_sync", "wordpress", "wordpress$PRODUCT$wordpress"]}