Description
Missing Authorization vulnerability in nfusionsolutions Precious Metals Automated Product Pricing &#8211; Pro precious-metals-automated-product-pricing-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Precious Metals Automated Product Pricing &#8211; Pro: from n/a through <= 4.0.5.
Published: 2026-04-08
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized privileged access
Action: Apply Update
AI Analysis

Impact

A missing authorization flaw allows a user to perform privileged actions within the Precious Metals Automated Product Pricing – Pro WordPress plugin. The vulnerability is classified as CWE‑862.

Affected Systems

The nfusionsolutions Precious Metals Automated Product Pricing – Pro plugin, all releases from the initial version through and including 4.0.5, is affected.

Risk and Exploitability

The CVSS score of 5.3 indicates medium risk, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires an authenticated WordPress user; the attacker would invoke privileged plugin functions that are intended to be restricted.

Generated by OpenCVE AI on April 8, 2026 at 16:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Precious Metals Automated Product Pricing – Pro to a version newer than 4.0.5
  • If an upgrade cannot be applied immediately, disable or lock the plugin until a patch is available
  • Restrict the user roles that have access to the plugin’s configuration functions

Generated by OpenCVE AI on April 8, 2026 at 16:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 08 Apr 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Nfusionsolutions
Nfusionsolutions precious Metals Automated Product Pricing &#8211; Pro
Wordpress
Wordpress wordpress
Vendors & Products Nfusionsolutions
Nfusionsolutions precious Metals Automated Product Pricing &#8211; Pro
Wordpress
Wordpress wordpress

Wed, 08 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Apr 2026 08:45:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in nfusionsolutions Precious Metals Automated Product Pricing &#8211; Pro precious-metals-automated-product-pricing-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Precious Metals Automated Product Pricing &#8211; Pro: from n/a through <= 4.0.5.
Title WordPress Precious Metals Automated Product Pricing – Pro plugin <= 4.0.5 - Broken Access Control vulnerability
Weaknesses CWE-862
References

Subscriptions

Nfusionsolutions Precious Metals Automated Product Pricing &#8211; Pro
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-08T13:28:44.754Z

Reserved: 2026-04-07T10:58:22.475Z

Link: CVE-2026-39704

cve-icon Vulnrichment

Updated: 2026-04-08T13:27:44.579Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-04-08T09:16:43.083

Modified: 2026-04-08T21:26:13.410

Link: CVE-2026-39704

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-08T19:40:15Z

Weaknesses