CVE-2026-19639 MEDIUM

CVE-2026-19639: Improper Access Control

Vendor Tenable, Inc.

Product Security Center

Weakness CWE-1284

Published August 14, 2026

Last update August 14, 2026

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope.

Key dates

02Disclosure timeline

August 14, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-19639 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1284.html AskarLabs — CWE-1284 write-up Improper Validation of Specified Quantity in Input

Related vulnerabilities

04Related CVE

CVE-2025-32689 WordPress Download Manager and Payment Form plugin <= 2.8.2 - Price Manipulation vulnerability CVE-2026-57364 WordPress Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More plugin <= 2.2.0 - Other Vulnerability Type vulnerability CVE-2026-49110 WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.4 - Price Manipulation vulnerability CVE-2026-49777 WordPress Product Slider Pro for WooCommerce plugin < 3.5.4 - Backdoor vulnerability CVE-2025-58835 WordPress Bonus for Woo plugin <= 7.6.6 - Other vulnerability Type vulnerability