CVE-2026-39776: CWE-94 Improper Control of Generation of Code ('Code Injection') in wpshopmart Tabs

This vulnerability (CVE-2026-39776) affects the wpshopmart Tabs plugin for WordPress, specifically versions 2.5 and earlier. It is categorized as CWE-94, indicating improper control of code generation, commonly known as code injection. The flaw allows an editor-level user to execute arbitrary code remotely, potentially compromising the system. The CVSS 3.1 vector indicates network attack vector, high attack complexity, requiring privileges at the editor level, no user interaction, and a scope change with high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with editor privileges to execute arbitrary code remotely, leading to full compromise of the affected system's confidentiality, integrity, and availability. This could result in unauthorized data access, modification, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor-level access to trusted users only and monitor for suspicious activity related to the Tabs plugin.