What is the CVSS score of CVE-2026-32406?

CVE-2026-32406 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-32406?

CVE-2026-32406 presents moderate security risk, a missing authorization vulnerability rated CVSS 4.3. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-32406?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-32406

EUVD-2026-11923 MEDIUM

Missing Authorization (CWE-862)

2026-03-13 Patchstack

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11923

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization vulnerability in WPClever WPC Product Bundles for WooCommerce woo-product-bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPC Product Bundles for WooCommerce: from n/a through <= 8.4.5.

AnalysisAI

WPC Product Bundles for WooCommerce versions through 8.4.5 contains a missing authorization flaw that allows authenticated users to exploit misconfigured access controls and access sensitive information. An attacker with valid WordPress credentials could leverage this vulnerability to view restricted data within the plugin. No patch is currently available for this medium-severity issue affecting WooCommerce installations.

Technical ContextAI

The vulnerability stems from CWE-862 (Missing Authorization), a class of security weakness where access control mechanisms fail to properly validate user permissions before granting access to sensitive resources. In the context of WPC Product Bundles for WooCommerce (CPE identifier: cpe:2.3:a:wpclever:wpc_product_bundles:*:*:*:*:*:wordpress:*:*), the plugin fails to enforce proper role-based access controls on administrative or sensitive endpoints. WooCommerce plugins extend WordPress functionality and handle e-commerce operations; when authorization checks are missing or misconfigured, authenticated users can escalate their effective privileges. This is particularly dangerous in e-commerce contexts where bundle pricing, discount structures, and inventory management are sensitive. The root cause involves inadequate capability checking in PHP code before returning or modifying sensitive product bundle data.

RemediationAI

Upgrade WPClever WPC Product Bundles for WooCommerce to a patched version greater than 8.4.5 immediately. Check the WPClever official website (wpclever.net) or the WordPress plugin repository for the latest available version and apply the update through the WordPress admin dashboard (Plugins > Installed Plugins > WPC Product Bundles > Update). Until patching is feasible, implement WordPress user role restrictions by reviewing and tightening user capabilities using role management plugins such as User Role Editor, and restrict access to bundle management pages to administrator accounts only. Additionally, audit user accounts to remove unnecessary low-privilege user access to WooCommerce admin functions, and consider implementing Web Application Firewall rules to monitor for unauthorized access patterns to product bundle endpoints.