What is the CVSS score of CVE-2026-32410?

CVE-2026-32410 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-32410?

CVE-2026-32410 presents moderate security risk, a missing authorization vulnerability rated CVSS 5.3. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-32410?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-32410

EUVD-2026-11927 MEDIUM

Missing Authorization (CWE-862)

2026-03-13 Patchstack

WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11927

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in WBW Plugins WBW Currency Switcher for WooCommerce woo-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WBW Currency Switcher for WooCommerce: from n/a through <= 2.2.5.

AnalysisAI

The WBW Currency Switcher for WooCommerce plugin through version 2.2.5 contains an authorization bypass vulnerability that allows unauthenticated remote attackers to modify plugin settings and configurations without proper access controls. This vulnerability affects WordPress sites running the vulnerable plugin versions and could enable attackers to alter currency settings or manipulate store functionality. No patch is currently available for this vulnerability.

Technical ContextAI

The vulnerability stems from CWE-862 (Missing Authorization), a class of access control flaws where an application fails to properly enforce authorization checks before performing sensitive operations. The WBW Currency Switcher for WooCommerce plugin (CPE: cpe:2.3:a:wbw:woo-currency:*:*:*:*:*:*:*:*) is a WordPress plugin designed to enable multi-currency functionality for WooCommerce stores. The root cause is an incorrectly configured access control security level that permits unauthenticated or unprivileged users to access administrative or sensitive functions, likely related to REST API endpoints or direct function calls that should be restricted to authenticated shop administrators. This is a common pattern in WordPress plugins where capability checks or nonce verification are omitted or misconfigured.

RemediationAI

Upgrade WBW Currency Switcher for WooCommerce to a patched version greater than 2.2.5 as soon as possible. Visit the plugin's page on wordpress.org or the vendor's website to download the latest version, then update via your WordPress admin dashboard. If a patched version is not yet available, consider temporarily disabling the plugin until a fix is released, and monitor the plugin repository for security updates. As an interim mitigation, restrict access to WooCommerce administrative pages using a Web Application Firewall (WAF) rule to allow only authenticated administrator IP addresses, and ensure your WordPress installation is fully updated with the latest security patches.