What is the CVSS score of CVE-2026-32417?

CVE-2026-32417 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Pochipp are affected by CVE-2026-32417?

Organizations using Missing Authorization vulnerability in wppochipp Pochipp pochipp should be aware of moderate risk from CVE-2026-32417, a missing authorization vulnerability rated CVSS 5.4.. A patch is available.

How to fix or mitigate CVE-2026-32417?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Pochipp CVE-2026-32417

EUVD-2026-11939 MEDIUM

Missing Authorization (CWE-862)

2026-03-13 Patchstack

Authentication Bypass Pochipp

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.18.9

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11939

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 5.4

DescriptionCVE.org

Missing Authorization vulnerability in wppochipp Pochipp pochipp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pochipp: from n/a through < 1.18.9.

AnalysisAI

Pochipp versions below 1.18.9 contain an authorization bypass vulnerability that allows authenticated users to access resources or perform actions beyond their assigned permissions due to improper access control validation. An attacker with valid credentials could exploit this to view sensitive data or modify system configuration they should not have access to. No patch is currently available.

Technical ContextAI

This vulnerability is classified as CWE-862 (Missing Authorization), which represents a failure to properly enforce access control decisions at the application level. Pochipp, a WordPress plugin component identified via CPE string references, implements role-based or privilege-level access controls that are incorrectly configured or insufficiently validated during request processing. Rather than a cryptographic or architectural flaw, this is a logical implementation error where the application fails to verify that the authenticated user possesses the necessary permissions before granting access to protected resources or functionality. The vulnerability likely exists in backend API endpoints, AJAX handlers, or administrative interface components where authorization checks are missing or bypassable.

RemediationAI

Immediately upgrade Pochipp to version 1.18.9 or later, which patches the missing authorization checks. Administrators should apply this update to all WordPress instances running affected Pochipp versions as a priority. As an interim measure pending patching, restrict access to Pochipp administrative interfaces and API endpoints using WordPress user role management, ensuring that only necessary roles possess elevated permissions, and consider implementing additional network-level access controls (WAF rules or IP whitelisting) to limit exposure to trusted users only. Conduct a post-patch access control audit to verify that all protected endpoints properly enforce authorization before granting resource access.