CVE-2026-32520
Published: 25 March 2026
Summary
CVE-2026-32520 is a critical-severity Incorrect Privilege Assignment (CWE-266) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-32520 is an Incorrect Privilege Assignment vulnerability (CWE-266) in the RewardsWP WordPress plugin, developed by Andrew Munro for AffiliateWP. The flaw allows privilege escalation and affects RewardsWP versions from n/a through 1.0.4.
With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability enables unauthenticated remote attackers to exploit it over the network with low complexity and no user interaction required. Successful exploitation grants attackers high-impact access to confidentiality, integrity, and availability, facilitating privilege escalation on affected WordPress sites.
The Patchstack advisory provides details on this privilege escalation vulnerability in the RewardsWP plugin version 1.0.4, available at https://patchstack.com/database/Wordpress/Plugin/rewardswp/vulnerability/wordpress-rewardswp-plugin-1-0-4-privilege-escalation-vulnerability?_s_id=cve.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15884
Vulnerability details
Incorrect Privilege Assignment vulnerability in Andrew Munro / AffiliateWP RewardsWP rewardswp allows Privilege Escalation.This issue affects RewardsWP: from n/a through <= 1.0.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote exploitation of a public-facing WordPress plugin vulnerability directly enables initial access via T1190 and results in privilege escalation via T1068.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the privilege escalation vulnerability by requiring identification, reporting, and remediation of the flaw in RewardsWP plugin versions through <=1.0.4.
Enforces least privilege principle to counter incorrect privilege assignment (CWE-266) that enables unauthenticated attackers to escalate privileges in the RewardsWP plugin.
Requires access enforcement mechanisms that address flawed privilege checks in the plugin, preventing unauthorized escalation despite the vulnerability.