Description
Missing Authorization vulnerability in nfusionsolutions Precious Metals Automated Product Pricing – Pro precious-metals-automated-product-pricing-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Precious Metals Automated Product Pricing – Pro: from n/a through <= 4.0.5.
Published: 2026-04-08
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The updated description reveals a missing authorization flaw that permits users to perform privileged actions within the Precious Metals Automated Product Pricing – Pro WordPress plugin, including modifying product pricing or accessing sensitive configuration data. The vulnerability is classified as CWE‑862.

Affected Systems

The nfusionsolutions Precious Metals Automated Product Pricing – Pro plugin, all releases from the initial version through and including 4.0.5, is affected.

Risk and Exploitability

The CVSS score of 5.3 indicates medium risk, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The issue is not listed in the CISA KEV catalog. Based on the updated description, the flaw appears exploitable via authenticated WordPress accounts, allowing them to invoke privileged plugin functions that are intended to be restricted.

Generated by OpenCVE AI on April 29, 2026 at 11:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Precious Metals Automated Product Pricing – Pro to a version newer than 4.0.5
  • If an upgrade cannot be applied immediately, disable or lock the plugin until a patch is available
  • Restrict the user roles that have access to the plugin’s configuration functions

Generated by OpenCVE AI on April 29, 2026 at 11:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 29 Apr 2026 10:15:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in nfusionsolutions Precious Metals Automated Product Pricing &#8211; Pro precious-metals-automated-product-pricing-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Precious Metals Automated Product Pricing &#8211; Pro: from n/a through <= 4.0.5. Missing Authorization vulnerability in nfusionsolutions Precious Metals Automated Product Pricing – Pro precious-metals-automated-product-pricing-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Precious Metals Automated Product Pricing – Pro: from n/a through <= 4.0.5.
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

 cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Wed, 08 Apr 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Nfusionsolutions
Nfusionsolutions precious Metals Automated Product Pricing &#8211; Pro
Wordpress
Wordpress wordpress
Vendors & Products Nfusionsolutions
Nfusionsolutions precious Metals Automated Product Pricing &#8211; Pro
Wordpress
Wordpress wordpress

Wed, 08 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 08 Apr 2026 08:45:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in nfusionsolutions Precious Metals Automated Product Pricing &#8211; Pro precious-metals-automated-product-pricing-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Precious Metals Automated Product Pricing &#8211; Pro: from n/a through <= 4.0.5.
Title WordPress Precious Metals Automated Product Pricing – Pro plugin <= 4.0.5 - Broken Access Control vulnerability
Weaknesses CWE-862
References

Subscriptions

Nfusionsolutions Precious Metals Automated Product Pricing &#8211; Pro
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-29T09:52:04.568Z

Reserved: 2026-04-07T10:58:22.475Z

Link: CVE-2026-39704

cve-icon Vulnrichment

Updated: 2026-04-08T13:27:44.579Z

cve-icon NVD

Status : Deferred

Published: 2026-04-08T09:16:43.083

Modified: 2026-04-29T10:17:42.737

Link: CVE-2026-39704

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T11:45:10Z

Weaknesses