The vulnerability identified as CVE-2026-39691 involves missing authorization controls in the AdAstraCrypto Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin, versions up to 2.2.13. This issue arises from incorrectly configured access control security levels, permitting unauthorized users to perform actions that should require authorization. The CVSS score of 5.3 reflects a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact is limited to integrity, with no confidentiality or availability impact reported. There is no vendor advisory or patch available at this time.

The vulnerability allows unauthorized users to perform actions that could modify or manipulate the donation box functionality, impacting the integrity of the system. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits have been reported in the wild, indicating limited current exploitation activity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review and tighten access control configurations where possible to limit unauthorized access. Monitor for updates from the vendor or security advisories for any forthcoming patches or mitigations.