CVE-2026-39690

The Author Avatars List/Block WordPress plugin (versions up to and including 2.1.25) is affected by a missing authorization vulnerability. This flaw falls under the category of broken access control, where the plugin fails to properly verify user permissions before allowing certain actions [1].

An attacker with low privileges, or possibly no authentication, can exploit this vulnerability by sending crafted requests to the plugin's functions that lack proper capability checks. The attack surface is the WordPress admin area or API endpoints exposed by the plugin [1].

Successful exploitation could allow an attacker to perform actions intended for higher-privileged users, such as modifying settings or accessing sensitive data, depending on the specific missing authorization checks. This can lead to unauthorized manipulation of site configurations [1].

As of now, users are strongly advised to update the plugin to the latest patched version. If immediate update is not possible, temporary workarounds such as restricting access via server-level rules or disabling the plugin should be considered [1].