This vulnerability (CVE-2026-39589) in Webenvo (<=0.0.6) is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. It allows users with subscriber privileges to upload arbitrary files, potentially enabling remote code execution or other severe impacts. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been provided by the vendor or in the advisory data.

Successful exploitation allows an attacker with subscriber-level access to upload arbitrary files, which can lead to full system compromise including unauthorized disclosure, modification, or destruction of data and disruption of service. The vulnerability affects confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber file upload permissions if possible or disable the vulnerable plugin to mitigate risk.