CVE-2026-32347: 
WordPress vulnerability analysis and mitigation

CVE-2026-32347 is a Missing Authorization (Broken Access Control) vulnerability in the "Restaurant and Cafe" WordPress theme developed by raratheme. It affects all versions up to and including 1.2.5, and was discovered by researcher Trương Hữu Phúc (truonghuuphuc) and reported on January 12, 2026, with public disclosure on February 11, 2026. The vulnerability was assigned a CVSS v3.1 base score of 5.3 (Medium), reflecting a low-impact, network-exploitable issue requiring no authentication or user interaction (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the theme fails to perform adequate authorization checks before executing certain privileged actions. An unauthenticated remote attacker can exploit incorrectly configured access control security levels to invoke functionality that should be restricted to higher-privileged users. No authentication, special configuration, or user interaction is required, and the attack complexity is low (Patchstack).

Exploitation of this vulnerability has a limited impact profile: there is no confidentiality or integrity impact, but a low availability impact is possible. An unauthenticated attacker could trigger restricted functionality within the theme, potentially causing minor disruption to affected WordPress sites. The vulnerability is rated low priority by Patchstack and is considered unlikely to be exploited for significant damage, though it may be leveraged in mass-exploit campaigns targeting large numbers of WordPress sites indiscriminately (Patchstack).

The vulnerability requires no privileges or user interaction and is exploitable remotely over the network, making it accessible to unauthenticated attackers. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of active exploitation in the near term. No public proof-of-concept exploit code, exploit kit integration, in-the-wild exploitation, or threat actor attribution has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

The vendor has released version 1.2.6 of the Restaurant and Cafe WordPress theme, which patches this vulnerability. Site administrators should update the theme to version 1.2.6 or later as the primary remediation step. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance. No specific configuration-based workaround has been published (Patchstack).