CVE-2026-32345: 
WordPress vulnerability analysis and mitigation

CVE-2026-32345 is a Missing Authorization (Broken Access Control) vulnerability in the raratheme Perfect Portfolio WordPress theme. It affects all versions up to and including 1.2.4, and was discovered by researcher Trương Hữu Phúc (truonghuuphuc), reported on January 12, 2026, and published on February 11, 2026. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium), with no authentication required for exploitation (Patchstack, Feedly).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the theme fails to properly verify whether a requesting user has the appropriate permissions before executing certain privileged actions. An unauthenticated remote attacker can exploit incorrectly configured access control security levels by sending crafted network requests to affected endpoints, bypassing authorization checks entirely. No special privileges or user interaction are required, and the attack complexity is low (Patchstack).

Successful exploitation of this vulnerability results in a limited availability impact (Low), with no confidentiality or integrity impact according to the CVSS scoring. The scope is unchanged, meaning the impact is confined to the vulnerable WordPress theme component itself. While the individual impact is low, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or popularity (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and no specific threat actor attribution has been made (Feedly, Patchstack).

The vendor has released a patched version of the Perfect Portfolio WordPress theme. Users should update to version 1.2.5 or later to remediate the vulnerability. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance. No specific configuration-based workaround has been published (Patchstack).