CVE-2026-32380

CVE-2026-32380 identifies a missing authorization vulnerability within the Numinous WordPress theme by raratheme. The issue stems from a broken access control in which security level checks are either missing or incorrectly configured. This affects all versions from n/a through 1.3.0. [1]

Exploitation of this vulnerability does not require authentication. An attacker can leverage the missing authorization to perform actions that should normally be restricted to higher-privileged users. The attack vector is over the network, and the complexity is low. [1]

The impact is classified as a medium severity (CVSS 3.1 base score 5.3) because it allows an attacker to exploit incorrectly configured access control security levels. The vulnerability is known to be used in mass-exploit campaigns targeting thousands of websites regardless of traffic or popularity. [1]

As an immediate mitigation, the vendor recommends updating the Numinous theme to a patched version if available, or applying a workaround such as disabling the theme until a fix is released. Site owners unable to update should consult their hosting provider or web developer for assistance. [1]