The vulnerability CVE-2026-39592 affects the Andy Ha DEPART plugin, specifically in the 'depart-deposit-and-part-payment-for-woo' functionality. It is caused by missing authorization controls, allowing users with some privileges to perform actions beyond their intended access level. The issue affects versions up to and including 1.0.7. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low attack complexity, requiring low privileges and no user interaction, impacting integrity but not confidentiality or availability.

Exploitation of this vulnerability could allow an attacker with limited privileges to perform unauthorized modifications, potentially affecting the integrity of data or operations within the affected plugin. There is no indication of impact on confidentiality or availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor for updates from the vendor or trusted security sources. Until a patch is available, restrict user privileges to the minimum necessary and review access controls related to the affected functionality.