The vulnerability CVE-2026-39610 affects the WpXmas-Snow plugin by Pankaj Kumar. It is caused by missing authorization checks due to incorrectly configured access control mechanisms. This allows unauthorized users to exploit the plugin and perform unauthorized actions. The affected versions include all versions up to and including 1.1. The CVSS 3.1 base score is 5.3, indicating a medium severity issue with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but an integrity impact. No official patch or vendor advisory is currently available, and no known exploits have been reported.

The vulnerability allows unauthorized users to perform actions that should be restricted, impacting the integrity of the affected system. There is no impact on confidentiality or availability. The medium severity score reflects the potential for unauthorized modification or manipulation within the plugin's functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor for updates from the vendor. Until a fix is available, consider restricting access to the plugin's functionality or disabling it if feasible to reduce risk.