TI-2026-67974 Aliases CVE-2026-39776 GHSA-4624-j47j-ffj8

WordPress Tabs plugin Remote Code Execution (RCE) vulnerability

LOW 37CWE-94Published 2026-10-06 · Updated 2026-10-06

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

The Editor component of the Tabs plugin for WordPress, published by wpshopmart, has a Remote Code Execution (RCE) vulnerability in versions through 2.5. It is classified as CWE-94 (Improper Control of Generation of Code, Code Injection). The CVSS 3.1 base score is 8.0 (HIGH), with vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. CISA SSVC rates exploitation as none and not automatable, with total technical impact, and CISA KEV does not list the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00348 28th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
wpshopmart	Tabs	up to 2.5	—	No fix listed	CNA

Tabs Vendorwpshopmart Affected up to 2.5 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Tabs through 2.5. Disable or remove the Tabs plugin until wpshopmart publishes a fixed release, and limit editor access to trusted users.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-06 Threatist record created from CVE-2026-39776
2026-10-06 Alias added: GHSA-4624-j47j-ffj8
2026-10-06 CISA SSVC decision points changed
2026-10-06 Priority changed: MEDIUM → LOW

References

Other 1

https://patchstack.com/database/wordpress/plugin/tabs-responsive/vulnerability/wordpress-tabs-plugin-2-5-remote-code-execution-rce-vulnerability?_s_id=cve

TI-2021-06483 WP Maintenance Mode & Site Under Construction < 1.8.2 - Arbitrary Plugin Installation/Activation via Low Privilege User CVSS 3.1HIGH 8.8
TI-2019-15243 Coming Soon Page & Maintenance Mode <= 1.8.1 - Stored Cross Site Scripting CVSS 3.1HIGH 7.2
TI-2019-15242 Coming Soon Page & Maintenance Mode <= 1.8.1 - Unauthenticated Settings Reset CVSS 3.1MEDIUM 6.5
TI-2024-01053 Coming Soon Page & Maintenance Mode <= 2.2.1 - Maintenance Mode Bypass CVSS 3.1MEDIUM 5.3
TI-2026-46720 WordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 5.9
TI-2021-14953 WordPress Testimonial Builder plugin <= 1.6.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 5.4

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences