CVE-2026-32501
Published: 25 March 2026
Summary
CVE-2026-32501 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 11.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for access to information and system resources, directly mitigating the missing authorization that allows low-privileged users to access sensitive configuration data in WP Configurator Pro.
Employs least privilege to restrict low-privileged users from accessing high-confidentiality configuration data exploited via the broken access control vulnerability.
Requires identification, reporting, and correction of flaws like the missing authorization in WP Configurator Pro versions <=3.7.9, preventing exploitation through patching.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization (CWE-862) in public-facing WordPress plugin allows low-priv remote attacker to access sensitive config data (C:H), directly enabling T1190 (exploit of Internet-facing app) and T1068 (exploit for unauthorized privilege/access escalation).
NVD Description
Missing Authorization vulnerability in wp-configurator WP Configurator Pro wp-configurator-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Configurator Pro: from n/a through <= 3.7.9.
Deeper analysisAI
CVE-2026-32501 is a missing authorization vulnerability (CWE-862) in the WP Configurator Pro WordPress plugin (wp-configurator-pro). It enables exploiting incorrectly configured access control security levels and affects all versions from n/a through 3.7.9. Published on 2026-03-25, the issue carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to network accessibility and significant confidentiality impact.
A low-privileged remote attacker (PR:L) can exploit this vulnerability over the network (AV:N) with low complexity (AC:L) and without user interaction (UI:N). Exploitation grants high confidentiality access (C:H), potentially exposing sensitive configuration data, alongside low integrity impact (I:L) such as limited modifications, while maintaining unchanged scope (S:U) and no availability disruption (A:N).
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/wp-configurator-pro/vulnerability/wordpress-wp-configurator-pro-plugin-3-7-9-broken-access-control-vulnerability?_s_id=cve) documents the broken access control vulnerability in WP Configurator Pro version 3.7.9, providing details for security practitioners to assess and address exposure in affected WordPress installations.
Details
- CWE(s)