What is the CVSS score of CVE-2026-32457?

CVE-2026-32457 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-32457?

CVE-2026-32457 presents moderate security risk, a missing authorization vulnerability rated CVSS 5.3. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-32457?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-32457

EUVD-2026-12013 MEDIUM

Missing Authorization (CWE-862)

2026-03-13 Patchstack

WordPress Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-12013

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 11:42 nvd

MEDIUM 5.3

DescriptionCVE.org

Missing Authorization vulnerability in Wombat Plugins Advanced Product Fields (Product Addons) for WooCommerce advanced-product-fields-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Product Fields (Product Addons) for WooCommerce: from n/a through <= 1.6.18.

AnalysisAI

Improper access control in Wombat Plugins Advanced Product Fields for WooCommerce through version 1.6.18 allows unauthenticated attackers to modify product addon data due to misconfigured authorization checks. This affects WooCommerce stores using the vulnerable plugin, enabling attackers to alter product information without proper permissions. No patch is currently available.

Technical ContextAI

This vulnerability is classified as CWE-862 (Missing Authorization), a fundamental access control flaw where the application fails to verify that a user has appropriate permissions before allowing actions on protected resources. The affected product is the Wombat Plugins Advanced Product Fields for WooCommerce plugin (CPE identifier: cpe:2.3:a:wombat:advanced-product-fields-for-woocommerce), which provides extended product customization capabilities in WooCommerce environments. The root cause stems from inadequate role-based access control (RBAC) implementation in the plugin's endpoints or API handlers that manage product addon and field configurations. WooCommerce plugins operating in this space typically interact with WordPress's user capability system, and this vulnerability indicates the plugin either fails to call wp_verify_nonce() for CSRF protection, omits capability checks via current_user_can(), or exposes administrative functions without proper authentication gates.

RemediationAI

Immediately upgrade the Advanced Product Fields for WooCommerce plugin to a version newer than 1.6.18, ensuring the latest patched release is deployed. Access the plugin's vendor advisory or WordPress plugin repository to confirm the patched version number and install via the WordPress admin dashboard or command-line tools. Until a patch can be applied, restrict direct access to WooCommerce product editing endpoints by implementing Web Application Firewall (WAF) rules that require authentication tokens for any POST/PUT requests to product endpoints, disable the plugin if not actively used, and monitor product database change logs for unauthorized modifications. For WooCommerce sites, verify that all user roles have appropriate capability restrictions and that plugin endpoints properly invoke wp_verify_nonce() and current_user_can() checks.