CVE-2026-32434

The VW Fitness theme for WordPress versions up to and including 4.3.4 contains a missing authorization vulnerability. This broken access control issue arises from insufficient checks on user permissions, allowing exploitation of incorrectly configured access control security levels [1].

Attackers can exploit this vulnerability without authentication, as the missing authorization check means no valid nonce or capability verification is performed. This makes it possible for unauthenticated users to perform actions that should be restricted to higher-privileged roles. The vulnerability is known to be used in mass-exploit campaigns targeting thousands of websites [1].

Successful exploitation could allow attackers to modify settings, access sensitive data, or perform other unauthorized actions depending on the specific functionality affected. The CVSS score of 5.3 indicates a medium severity, but the ease of exploitation and potential for widespread attacks increases the risk [1].

Users are strongly advised to update the VW Fitness theme to a patched version beyond 4.3.4. If immediate update is not possible, contact your hosting provider or web developer for assistance [1].