Advanced Related Posts CVE-2026-32329

The CVSS v3.1 score of 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N indicates a medium-severity vulnerability with favorable attack conditions for adversaries: network-accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N). While the integrity impact is limited (I:L) and confidentiality and availability are unaffected, the lack of authentication requirements and straightforward exploitation path suggests real-world exploitability. Without confirmed EPSS data, KEV status, or public proof-of-concept details provided, the actual exploitation probability cannot be definitively assessed, but the missing authorization flaw in a WordPress plugin with broad deployment suggests this should be treated as a priority remediation for affected organizations. The absence of authentication bypass protections makes this a material security gap despite the moderate CVSS score.

An unauthenticated attacker can send a network request to the vulnerable Advanced Related Posts plugin endpoint without providing valid credentials or authentication tokens. Due to the missing authorization checks, the plugin processes the request and allows the attacker to modify plugin settings, inject malicious content into related posts functionality, or alter configuration parameters that affect site visitors. Because the attack vector is network-based and requires no user interaction or special privileges, an attacker can automate exploitation across multiple WordPress installations running the vulnerable plugin versions.