CVE-2026-32386

The vulnerability is a missing authorization (broken access control) in the Envo Extra plugin for WordPress, affecting versions up to and including 1.9.13. The plugin fails to properly enforce access control checks, allowing exploitation of incorrectly configured security levels [1].

Attackers can exploit this vulnerability without authentication, as the missing authorization check means no valid session or privileges are required. The attack vector is network-based with low complexity, and no user interaction is needed. This makes it suitable for mass-exploit campaigns targeting thousands of websites [1].

Successful exploitation could allow an attacker to perform actions that should be restricted to higher-privileged users, such as modifying plugin settings or accessing sensitive data. The CVSS score of 4.3 indicates a medium severity, but the potential for widespread automated attacks increases the real-world risk [1].

The vendor has released version 1.9.14 to address the issue. Users are strongly advised to update immediately. For those unable to update, consulting a hosting provider or web developer is recommended. Patchstack users can enable auto-updates for vulnerable plugins [1].