What is the CVSS score of CVE-2026-32423?

CVE-2026-32423 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2026-32423?

CVE-2026-32423 presents moderate security risk, a missing authorization vulnerability rated CVSS 5.4. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-32423?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Wordpress Plugin CVE-2026-32423

EUVD-2026-11951 MEDIUM

Missing Authorization (CWE-862)

2026-03-13 Patchstack

WordPress Authentication Bypass Wordpress Plugin Admin And Site Enhancements Ase Bowo

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-11951

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 5.4

DescriptionCVE.org

Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 8.4.0.

AnalysisAI

Authenticated users with insufficient access control restrictions in Admin and Site Enhancements (ASE) versions 8.4.0 and earlier can bypass authorization checks to read and modify sensitive data. The vulnerability stems from improperly configured access control levels that fail to enforce proper privilege boundaries. An attacker with valid credentials can exploit this to gain unauthorized access to protected functionality without elevated permissions.

Technical ContextAI

The vulnerability resides in the Admin and Site Enhancements (ASE) WordPress plugin, which extends administrative capabilities through custom access control mechanisms. The root cause is classified as CWE-862 (Missing Authorization), indicating that the plugin fails to properly validate whether an authenticated user has sufficient privileges before granting access to sensitive administrative functions. Rather than implementing robust role-based access control (RBAC) checks at each privilege-critical operation, the plugin appears to rely on insufficient or missing authorization logic. The affected CPE profile is cpe:2.3:a:bowo:admin_site_enhancements, with vulnerability spanning versions from initial release through 8.4.0. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates network accessibility with low attack complexity, requiring only low privileges and no user interaction, resulting in limited confidentiality and integrity impact.

RemediationAI

Immediately upgrade Bowo Admin and Site Enhancements (ASE) to the latest patched version beyond 8.4.0 when available from the vendor. Check the official WordPress plugin repository or Bowo's security advisories for the specific patched version number and download instructions. As an interim mitigation prior to patching, restrict plugin administrative functions through WordPress role management, limiting which user roles can access sensitive admin pages (use the 'manage_options' capability checks via WordPress hooks). Audit existing user accounts and revoke unnecessary administrative or elevated privileges to reduce the attack surface. Monitor administrative logs and audit trails for unauthorized access attempts or privilege escalation activities. Additionally, implement Web Application Firewall (WAF) rules to detect and block requests attempting to access sensitive admin endpoints via parameter tampering or unauthorized role changes, if feasible within your WordPress environment.