Lawyer Landing Page CVE-2026-32487

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates moderate real-world risk: any network attacker without authentication can modify data, but cannot read sensitive information or cause denial of service. The integrity impact is limited in scope, affecting only the specific function lacking authorization rather than the entire system. The attack complexity is low and requires no user interaction, making exploitation trivial once discovered. Without confirmed EPSS score data or KEV (CISA Known Exploited Vulnerabilities) listing, the practical urgency cannot be definitively assessed; however, missing authorization flaws in WordPress plugins are frequently discovered and exploited opportunistically by automated scanners. The CVSS 5.3 score should not be dismissed as low-priority—integrity compromise via missing authorization is a common entry point for defacement, malicious form modification, and lateral movement in WordPress environments. Organizations using this plugin should prioritize patching based on whether the affected plugin functions handle sensitive data (client information, case details, testimonials).

An unauthenticated attacker discovers the vulnerable endpoint in the Lawyer Landing Page plugin (e.g., a form handler or AJAX endpoint lacking nonce and capability checks) and sends a crafted HTTP request to modify client testimonials, case descriptions, or contact form data. Because the plugin does not validate authorization before processing the request, the modification succeeds without requiring WordPress user credentials. The attacker repeats this attack across multiple installations, defacing law firm websites or injecting malicious content into client-facing pages. No proof-of-concept code has been publicly confirmed, but the low attack complexity means exploitation would be straightforward once reverse-engineered from the plugin code.