{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39602", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-07T10:48:50.116Z", "datePublished": "2026-04-08T08:30:21.845Z", "dateUpdated": "2026-04-13T19:35:37.088Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "order-tracking", "product": "Order Tracking", "vendor": "Rustaurius", "versions": [{"lessThanOrEqual": "3.4.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jakub Herman | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-08T10:28:33.998Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Rustaurius Order Tracking order-tracking allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Order Tracking: from n/a through <= 3.4.3.</p>"}], "value": "Missing Authorization vulnerability in Rustaurius Order Tracking order-tracking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Tracking: from n/a through <= 3.4.3."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:21.845Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/order-tracking/vulnerability/wordpress-order-tracking-plugin-3-4-3-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Order Tracking plugin <= 3.4.3 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-13T18:38:35.154600Z", "id": "CVE-2026-39602", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T19:35:37.088Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39602", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T18:38:35.154600Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T18:19:58.465Z"}}], "cna": {"title": "WordPress Order Tracking plugin <= 3.4.3 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Jakub Herman | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "Rustaurius", "product": "Order Tracking", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.4.3"}], "packageName": "order-tracking", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-08T10:28:33.998Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/order-tracking/vulnerability/wordpress-order-tracking-plugin-3-4-3-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Rustaurius Order Tracking order-tracking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Tracking: from n/a through <= 3.4.3.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Rustaurius Order Tracking order-tracking allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Order Tracking: from n/a through <= 3.4.3.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:21.845Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39602", "state": "PUBLISHED", "dateUpdated": "2026-04-13T19:35:37.088Z", "dateReserved": "2026-04-07T10:48:50.116Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-04-08T08:30:21.845Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Rustaurius Order Tracking order-tracking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Tracking: from n/a through <= 3.4.3."}], "id": "CVE-2026-39602", "lastModified": "2026-04-13T20:16:36.800", "metrics": {}, "published": "2026-04-08T09:16:29.340", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/order-tracking/vulnerability/wordpress-order-tracking-plugin-3-4-3-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.4.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Order Tracking", "source": "cna", "vendor": "Rustaurius"}, "product": "order_tracking", "vendor": "rustaurius"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-13T21:52:01.989814+00:00", "value": {"mitigation_remediation": ["Update the Order Tracking plugin to a version newer than 3.4.3 as soon as possible.", "If an immediate update is not possible, restrict public access to order history pages so that only authorized administrators can view them.", "Monitor web access logs for attempts to retrieve order data and apply rate limiting or IP blocking to mitigate repeated probing."], "summary": {"action": "Patch Now", "impact": "unauthorized disclosure of order data"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Rustaurius:Order Tracking plugin for WordPress. All releases from the initial version through version 3.4.3 are impacted.", "description_and_impact": "A missing authorization flaw in the Rustaurius Order Tracking WordPress plugin permits an attacker to bypass normal access controls and view order data stored by the plugin. The weakness, identified as CWE\u2011862, allows access to order records without authentication, thereby compromising confidentiality of that data.", "risk_and_exploitability": "The EPSS score is reported as under 1%, suggesting that exploitation is unlikely to be widespread. The issue is not listed in the CISA KEV catalog, indicating no known public exploitation. Because the plugin is exposed via a WordPress site, the likely attack vector is a web request to a plugin endpoint, but the specific request format is not detailed in the advisory."}}}}, "created": "2026-04-08T19:29:57.641099+00:00", "updated": "2026-04-14T16:39:45.068294+00:00", "vendors": ["rustaurius", "rustaurius$PRODUCT$order_tracking", "wordpress", "wordpress$PRODUCT$wordpress"]}