The vulnerability identified as CVE-2026-39610 affects the WpXmas-Snow plugin by Pankaj Kumar. It involves missing authorization controls, meaning that certain actions or resources may be accessible without proper permission checks due to misconfigured access control settings. The affected versions include all versions up to 1.1. No patch or official fix information is available, and the vulnerability has been publicly disclosed without further technical details or exploitation reports.

The impact of this vulnerability is that unauthorized users may be able to perform actions or access functionality that should be restricted, potentially leading to unauthorized changes or information disclosure within the context of the WpXmas-Snow plugin. However, without detailed technical or exploit information, the exact impact scope cannot be fully assessed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin's functionality to trusted users only and monitor for updates from the vendor or security advisories.