CVE-2026-39470 is a privilege escalation vulnerability in Brainstorm Force WooCommerce Cart Abandonment Recovery plugin versions before 2.1.0. The issue arises from incorrect privilege assignment, enabling users with shop manager roles to escalate their privileges beyond intended limits. The CVSS 3.1 base score is 7.2, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. Confidentiality, integrity, and availability impacts are all high. No official patch or remediation guidance has been published yet, and no known exploits are reported in the wild.

Successful exploitation could allow a user with shop manager privileges to escalate their access rights, potentially leading to full control over the WooCommerce environment. This could compromise the confidentiality, integrity, and availability of the affected system and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict shop manager role assignments to trusted users only and monitor for unusual privilege escalations.