What is the CVSS score of CVE-2026-32407?

CVE-2026-32407 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-32407?

CVE-2026-32407 presents moderate security risk, a missing authorization vulnerability rated CVSS 4.3. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-32407?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-32407

EUVD-2026-11924 MEDIUM

Missing Authorization (CWE-862)

2026-03-13 Patchstack

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11924

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 4.3

DescriptionCVE.org

Missing Authorization vulnerability in WPClever WPC Smart Wishlist for WooCommerce woo-smart-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPC Smart Wishlist for WooCommerce: from n/a through <= 5.0.8.

AnalysisAI

Improper access control in WPC Smart Wishlist for WooCommerce through version 5.0.8 permits authenticated users to modify wishlist data they should not have authorization to access. An attacker with valid WordPress credentials could exploit misconfigured permission checks to alter or manipulate wishlist information belonging to other users.

Technical ContextAI

The vulnerability is rooted in CWE-862 (Missing Authorization), which indicates that the application fails to properly validate whether an authenticated user has the requisite permissions to perform specific actions on protected resources. WPC Smart Wishlist for WooCommerce (identified via CPE cpe:2.3:a:wpclever:wpc_smart_wishlist) is a WordPress plugin that manages customer wishlists in WooCommerce environments. The plugin accepts requests from authenticated users but does not adequately enforce role-based or user-level authorization checks on wishlist management endpoints, allowing an attacker with valid WooCommerce account credentials (such as a customer account) to access or modify wishlist objects belonging to other users. The vulnerability stems from insufficient server-side authorization logic that relies on client-side controls or inadequate parameter validation rather than cryptographic or capability-based access enforcement.

RemediationAI

Upgrade WPC Smart Wishlist for WooCommerce to version 5.0.9 or later, which patches the authorization vulnerability. To perform the upgrade, log into the WordPress admin panel, navigate to Plugins > Installed Plugins, locate WPC Smart Wishlist for WooCommerce, and click Update if available; alternatively, download the patched version directly from the official WordPress.org plugin repository. For sites unable to upgrade immediately, consider temporarily disabling the wishlist feature at the WordPress admin level, restricting WooCommerce access to trusted users only via IP whitelisting, or implementing a Web Application Firewall (WAF) rule to monitor and block suspicious wishlist API requests that exhibit cross-user access patterns. Verify the patch in a staging environment before deploying to production. After patching, audit wishlist tables in the WordPress database for unauthorized modifications made during the window of exposure to assess if customer data was compromised.