{"id":"CVE-2026-39776","published":"2026-10-06T09:17:50.347","lastModified":"2026-10-06T15:04:25.990","description":"Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.","cvssScore":8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/tabs-responsive/vulnerability/wordpress-tabs-plugin-2-5-remote-code-execution-rce-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A remote code execution vulnerability exists in the Tabs plugin for WordPress versions up to 2.5, allowing attackers to execute arbitrary code on the server with high privileges. This represents a critical security flaw that can lead to complete server compromise.","exploitability":"Exploitation requires a privileged user account (PR:H) and is moderately difficult due to high attack complexity (AC:H), but becomes more feasible when combined with other vulnerabilities or misconfigurations.","blast_radius":"If exploited, this vulnerability could allow attackers to gain full control over the WordPress site, potentially leading to data breaches, defacement, or use as a launchpad for further attacks on the network.","remediation":"Upgrade to Tabs plugin version 2.590 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","wordpress","plugin","remote-code-execution"],"model":"garnet-coder","analyzedAt":"2026-10-14T09:00:04.409Z"}}