Bakes And Cakes CVE-2026-32339

The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects a relatively contained but real threat: network-accessible with low complexity, no authentication required, affecting only integrity with limited scope. The integrity impact is marked as low rather than high, suggesting the unauthorized modification possible is bounded in nature rather than critical system compromise. The absence of confidentiality or availability impact further limits the severity; this is not a data exfiltration or denial-of-service vector. However, the CVSS score of 5.3 places this in the medium range, and for WordPress plugins—where thousands of sites may run the same vulnerable code—even moderate vulnerabilities warrant prompt patching. Without confirmed EPSS data, public POC code, or KEV catalog inclusion available in this analysis, the real-world exploitation probability remains moderate; however, authorization bypass vulnerabilities are typically straightforward to exploit once discovered and are often caught by security scanners, making active exploitation likely if patches lag. Organizations should prioritize patching but may defer non-critical mitigations pending confirmation of active exploitation.

An unauthenticated attacker could directly craft HTTP requests to vulnerable WordPress AJAX handlers or REST API endpoints exposed by the Bakes And Cakes plugin, bypassing authorization checks to modify sensitive configuration, create unauthorized content, or alter site settings without logging in. For example, an attacker might POST directly to an administrative function URL with parameters to modify product listings, pricing, or plugin settings that should have been restricted to authenticated administrators. The low complexity and absence of user interaction requirements mean automated scanning and exploitation tools could readily identify and exploit this flaw across multiple WordPress installations simultaneously.