What is the CVSS score of CVE-2026-32441?

CVE-2026-32441 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-32441?

CVE-2026-32441 presents notable security risk, a missing authorization vulnerability rated CVSS 7.7.

How to fix or mitigate CVE-2026-32441?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

WordPress CVE-2026-32441

EUVD-2026-15821 HIGH

Missing Authorization (CWE-862)

2026-03-25 Patchstack

WordPress Authentication Bypass

7.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15821

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 7.7

DescriptionCVE.org

Missing Authorization vulnerability in WebToffee Comments Import & Export comments-import-export-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comments Import & Export: from n/a through <= 2.4.9.

AnalysisAI

A missing authorization vulnerability exists in WebToffee Comments Import & Export for WooCommerce (versions up to 2.4.9) that allows attackers to exploit incorrectly configured access control, potentially enabling unauthorized comment manipulation. The vulnerability is classified as CWE-862 (Missing Authorization), affecting WordPress installations using this plugin. Attackers with low or no privileges may be able to bypass authentication mechanisms to perform unauthorized actions on comment data.

Technical ContextAI

The vulnerability resides in the WebToffee Comments Import & Export plugin (CPE: cpe:2.3:a:webtoffee:comments_import_&_export:*:*:*:*:*:*:*:*), a WordPress plugin designed to facilitate bulk import and export operations of WooCommerce comments. The root cause is classified under CWE-862 (Missing Authorization), which indicates the application fails to properly enforce access control checks before allowing sensitive operations. This typically manifests in WordPress plugins when capability checks (such as checking user roles or nonces) are omitted from AJAX endpoints, REST API routes, or administrative functions. The plugin's comment handling logic likely lacks proper verification that the requesting user has the required permissions before executing import/export or comment modification operations, allowing authenticated users with lower privileges or potentially unauthenticated actors to access restricted functionality.

RemediationAI

Immediately upgrade WebToffee Comments Import & Export plugin to a version newer than 2.4.9 if a patched version is available (consult the plugin's official WordPress.org page or vendor site for the latest secure release). If a patched version is not yet available, disable the plugin temporarily or restrict access to import/export functionality by removing user capabilities via WordPress role management and code snippets. As an interim control, restrict access to the plugin's admin pages using HTTP Basic Authentication or IP allowlisting at the web server level. Additionally, audit existing comment data for unauthorized modifications or injected content, and enable WordPress security logging to monitor for suspicious comment import/export activity. Review user roles and remove unnecessary permissions from low-privilege accounts that should not have comment management access.