CVE-2026-39594 is a missing authorization vulnerability (CWE-862) in Themefic's Ultra Addons for WPForms plugin, affecting all versions up to and including 1.0.11. The flaw allows subscriber-level users to bypass intended access controls, which can result in partial integrity and availability impacts. The vulnerability has a CVSS 3.1 score of 6.4 with network attack vector, low attack complexity, requiring privileges at the level of a subscriber, no user interaction, and scope changed. No vendor advisory or patch is currently available, and no known exploits have been reported.

An attacker with subscriber privileges can exploit this missing authorization to perform actions beyond their intended permissions, potentially modifying data or disrupting service availability. Confidentiality is not impacted. The scope change indicates that the vulnerability affects resources beyond the initially authorized scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber privileges where possible and monitor for unusual activity related to the plugin. Avoid granting unnecessary permissions to subscriber roles.